hmz007
36ed224bac
Signed-off-by: hmz007 <hmz007@gmail.com> Change-Id: Ib87fdbe7a0be7dc961af3500fe9ea4589a127f9f
12 lines
500 B
Plaintext
12 lines
500 B
Plaintext
iptables-translate -A FORWARD -p esp -j ACCEPT
|
|
nft add rule ip filter FORWARD ip protocol esp counter accept
|
|
|
|
iptables-translate -A INPUT --in-interface wan --protocol esp -j ACCEPT
|
|
nft add rule ip filter INPUT iifname "wan" ip protocol esp counter accept
|
|
|
|
iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP
|
|
nft add rule ip filter INPUT esp spi 500 counter drop
|
|
|
|
iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP
|
|
nft add rule ip filter INPUT esp spi 500-600 counter drop
|