| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 1 | ebtables-translate -A FORWARD -p ip6 --ip6-src ! dead::beef/64 -j ACCEPT |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 2 | nft add rule bridge filter FORWARD ip6 saddr != dead::/64 counter accept |
| 3 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 4 | ebtables-translate -A FORWARD -p ip6 ! --ip6-dst dead:beef::/64 -j ACCEPT |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 5 | nft add rule bridge filter FORWARD ip6 daddr != dead:beef::/64 counter accept |
| 6 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 7 | ebtables-translate -I FORWARD -p ip6 --ip6-dst f00:ba:: |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 8 | nft insert rule bridge filter FORWARD ip6 daddr f00:ba:: counter |
| 9 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 10 | ebtables-translate -I OUTPUT -o eth0 -p ip6 --ip6-tclass 0xff |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 11 | nft insert rule bridge filter OUTPUT oifname "eth0" ip6 dscp 0x3f counter |
| 12 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 13 | ebtables-translate -A FORWARD -p ip6 --ip6-proto tcp --ip6-dport 22 |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 14 | nft add rule bridge filter FORWARD ether type ip6 tcp dport 22 counter |
| 15 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 16 | ebtables-translate -A FORWARD -p ip6 --ip6-proto udp --ip6-sport 1024:65535 |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 17 | nft add rule bridge filter FORWARD ether type ip6 udp sport 1024-65535 counter |
| 18 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 19 | ebtables-translate -A FORWARD -p ip6 --ip6-proto 253 |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 20 | nft add rule bridge filter FORWARD ether type ip6 meta l4proto 253 counter |
| 21 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 22 | ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type "echo-request" |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 23 | nft add rule bridge filter FORWARD icmpv6 type 128 counter |
| 24 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 25 | ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type 1/1 |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 26 | nft add rule bridge filter FORWARD icmpv6 type 1 icmpv6 code 1 counter |
| 27 | |
| Florian Westphal | 6454d7d | 2018-05-08 10:15:11 +0200 | [diff] [blame] | 28 | ebtables-translate -A FORWARD -p ip6 --ip6-protocol icmpv6 --ip6-icmp-type ! 1:10 |
| Florian Westphal | 5c8ce9c | 2018-04-19 11:19:52 +0200 | [diff] [blame] | 29 | nft add rule bridge filter FORWARD icmpv6 type != 1-10 counter |