<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Flowtable - Bug on devices deinition"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1700#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Flowtable - Bug on devices deinition"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1700">bug 1700</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>1) Your ruleset determines what flows are added to the flowtable. Below your
ruleset adds entries to the flowtable for UDP packets coming in from eth1 and
eth2.
2) The devices you specify in the flowtable declaration determine where the
flowtable hooks in the pipeline for lookups, in the example below, it registers
a hook for devices eth1 and eth2 in the ingress hook at priority 0.
The ruleset should be:
table ip vyos_filter {
flowtable ft_test {
hook ingress priority filter
devices = { eth1, eth2 }
}
chain VYOS_FORWARD_filter {
type filter hook forward priority filter; policy accept;
iifname { "eth1", "eth2" } ip protocol udp counter flow add @ft_test
meta l4proto { tcp, udp } counter accept comment
"FWD-filter-10"
}
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>