<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - iptables translation issues"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1362">1362</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>iptables translation issues
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables over nftable
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>arturo@debian.org
</td>
</tr></table>
<p>
<div>
<pre>Bug originally reported in the Debian tracker:
<a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916918">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916918</a>
It probably contains several different issues in the same reports, sorry for
that. But the report contains useful information to reproduce each case anyway.
Original message follows:
bash# iptables-translate -A INPUT -s 0.0.0.0/8 -j DROP
nft add rule ip filter INPUT counter drop
bash#
(ignores source address match to yield a rule that drops everything)
(0.0.0.0/8 != 0.0.0.0/0)
bash# iptables-translate -6 -A protect-re -s 2001:db8:19::/64 -p tcp
--sport 80 -j ACCEPT
nft add rule ip filter protect-re ip6 saddr 2001:db8::ffff:ffff:0:0/0
tcp sport 80 counter accept
bash#
(borks the source address match completely)
The last example is converted correctly by ip6tables-translate. But as I
used to have ipv4 and ipv6 rules in the same file, I'm baffled by why
iptables-restore-translate even tries to convert the ipv6 rules. Surely
it should just skip them?
I also ran into a baffling error message for a rule that uses the
multiport module, and couldn't find a workaround or even what the real
problem was:
iptables-translate-restore v1.8.2 (nf_tables): multiport needs `-p tcp',
`-p udp', `-p udplite', `-p sctp' or `-p dccp'
Here's an attempt to manually translate the line in question:
bash# iptables-translate -4 -A protect-re -m multiport -p udp -s
10.0.0.0/24 --ports 161,514 -j ACCEPT
nft # -4 -A protect-re -m multiport -p udp -s 10.0.0.0/24 --ports
161,514 -j ACCEPT
bash#</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>