<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - vmap and sets cause "BUG: invalid range expression type set""
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1179#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - vmap and sets cause "BUG: invalid range expression type set""
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1179">bug 1179</a>
from <span class="vcard"><a class="email" href="mailto:netfilter@allycomm.com" title="Jeff Kletsky <netfilter@allycomm.com>"> <span class="fn">Jeff Kletsky</span></a>
</span></b>
<pre>Should someone come across this and have a similar application, the following
appears to meet the use case outlined above. Output from # nft list ruleset
table inet global {
set blackhole_ipv4 {
type ipv4_addr
flags interval
elements = { 0.0.0.0/8, 10.0.0.0/8,
100.64.0.0/10, 127.0.0.0/8,
169.254.0.0/16, 172.16.0.0/12,
192.0.0.0/24, 192.0.2.0/24,
192.18.0.0/15, 192.42.172.0/24,
192.88.99.0/24, 192.168.0.0/16,
198.51.100.0/24, 203.0.113.0/24,
224.0.0.0-255.255.255.255 }
}
chain drop_ext_prerouting_pre_nat {
ip saddr != { 192.168.0.0/24 } ip saddr @blackhole_ipv4 log prefix
"Unacceptable blackhole src: " drop
ip daddr != { 192.168.0.100, 192.168.6.255 } ip daddr @blackhole_ipv4
log prefix "Unacceptable blackhole dst: " drop
return
}
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>