Blame extensions/libxt_tcp.txlate
|
Packit |
7b22a4 |
iptables-translate -A INPUT -p tcp -i eth0 --sport 53 -j ACCEPT
|
|
Packit |
7b22a4 |
nft add rule ip filter INPUT iifname "eth0" tcp sport 53 counter accept
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -A OUTPUT -p tcp -o eth0 --dport 53:66 -j DROP
|
|
Packit |
7b22a4 |
nft add rule ip filter OUTPUT oifname "eth0" tcp dport 53-66 counter drop
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -I OUTPUT -p tcp -d 8.8.8.8 -j ACCEPT
|
|
Packit |
7b22a4 |
nft insert rule ip filter OUTPUT ip protocol tcp ip daddr 8.8.8.8 counter accept
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -I OUTPUT -p tcp --dport 1020:1023 --sport 53 -j ACCEPT
|
|
Packit |
7b22a4 |
nft insert rule ip filter OUTPUT tcp sport 53 tcp dport 1020-1023 counter accept
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
|
|
Packit |
7b22a4 |
nft add rule ip filter INPUT tcp flags & fin|ack == fin counter drop
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -A INPUT -p tcp --syn -j ACCEPT
|
|
Packit |
7b22a4 |
nft add rule ip filter INPUT tcp flags & (fin|syn|rst|ack) == syn counter accept
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -A INPUT -p tcp --syn --dport 80 -j ACCEPT
|
|
Packit |
7b22a4 |
nft add rule ip filter INPUT tcp dport 80 tcp flags & (fin|syn|rst|ack) == syn counter accept
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -A INPUT -f -p tcp
|
|
Packit |
7b22a4 |
nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 ip protocol tcp counter
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
iptables-translate -A INPUT ! -f -p tcp --dport 22
|
|
Packit |
7b22a4 |
nft add rule ip filter INPUT ip frag-off & 0x1fff 0 tcp dport 22 counter
|