1*a71a9546SAutomerger Merge Workeriptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT 2*a71a9546SAutomerger Merge Workernft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept' 3*a71a9546SAutomerger Merge Worker 4*a71a9546SAutomerger Merge Workeriptables-translate -F -t nat 5*a71a9546SAutomerger Merge Workernft flush table ip nat 6*a71a9546SAutomerger Merge Worker 7*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT -i iifname -s 10.0.0.0/8 8*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT iifname "iifname" ip saddr 10.0.0.0/8 counter' 9*a71a9546SAutomerger Merge Worker 10*a71a9546SAutomerger Merge Workeriptables-translate -A INPUT -i iif+ ! -d 10.0.0.0/8 11*a71a9546SAutomerger Merge Workernft 'add rule ip filter INPUT iifname "iif*" ip daddr != 10.0.0.0/8 counter' 12*a71a9546SAutomerger Merge Worker 13*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT -s 10.11.12.13/255.255.0.0 14*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT ip saddr 10.11.0.0/16 counter' 15*a71a9546SAutomerger Merge Worker 16*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT -s 10.11.12.13/255.0.255.0 17*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT ip saddr & 255.0.255.0 == 10.0.12.0 counter' 18*a71a9546SAutomerger Merge Worker 19*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT -s 10.11.12.13/0.255.0.255 20*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT ip saddr & 0.255.0.255 == 0.11.0.13 counter' 21*a71a9546SAutomerger Merge Worker 22*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT ! -s 10.11.12.13/0.255.0.255 23*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT ip saddr & 0.255.0.255 != 0.11.0.13 counter' 24*a71a9546SAutomerger Merge Worker 25*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT -s 0.0.0.0/16 26*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT ip saddr 0.0.0.0/16 counter' 27*a71a9546SAutomerger Merge Worker 28*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT -s 0.0.0.0/0 29*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT counter' 30*a71a9546SAutomerger Merge Worker 31*a71a9546SAutomerger Merge Workeriptables-translate -I INPUT ! -s 0.0.0.0/0 32*a71a9546SAutomerger Merge Workernft 'insert rule ip filter INPUT ip saddr != 0.0.0.0/0 counter' 33*a71a9546SAutomerger Merge Worker 34*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT -i iifname -s feed::/16 35*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT iifname "iifname" ip6 saddr feed::/16 counter' 36*a71a9546SAutomerger Merge Worker 37*a71a9546SAutomerger Merge Workerip6tables-translate -A INPUT -i iif+ ! -d feed::/16 38*a71a9546SAutomerger Merge Workernft 'add rule ip6 filter INPUT iifname "iif*" ip6 daddr != feed::/16 counter' 39*a71a9546SAutomerger Merge Worker 40*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT -s feed:babe::1/ffff:ff00:: 41*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT ip6 saddr feed:ba00::/24 counter' 42*a71a9546SAutomerger Merge Worker 43*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/ffff:0:ffff:0:ffff:0:ffff:0 44*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT ip6 saddr & ffff:0:ffff:0:ffff:0:ffff:0 == feed:0:c0ff:0:c0be:0:5678:0 counter' 45*a71a9546SAutomerger Merge Worker 46*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/0:ffff:0:ffff:0:ffff:0:ffff 47*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT ip6 saddr & 0:ffff:0:ffff:0:ffff:0:ffff == 0:babe:0:ee00:0:1234:0:90ab counter' 48*a71a9546SAutomerger Merge Worker 49*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT ! -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/0:ffff:0:ffff:0:ffff:0:ffff 50*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT ip6 saddr & 0:ffff:0:ffff:0:ffff:0:ffff != 0:babe:0:ee00:0:1234:0:90ab counter' 51*a71a9546SAutomerger Merge Worker 52*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT -s ::/16 53*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT ip6 saddr ::/16 counter' 54*a71a9546SAutomerger Merge Worker 55*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT -s ::/0 56*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT counter' 57*a71a9546SAutomerger Merge Worker 58*a71a9546SAutomerger Merge Workerip6tables-translate -I INPUT ! -s ::/0 59*a71a9546SAutomerger Merge Workernft 'insert rule ip6 filter INPUT ip6 saddr != ::/0 counter' 60*a71a9546SAutomerger Merge Worker 61*a71a9546SAutomerger Merge Workerebtables-translate -I INPUT -i iname --logical-in ilogname -s 0:0:0:0:0:0 62*a71a9546SAutomerger Merge Workernft 'insert rule bridge filter INPUT iifname "iname" meta ibrname "ilogname" ether saddr 00:00:00:00:00:00 counter' 63*a71a9546SAutomerger Merge Worker 64*a71a9546SAutomerger Merge Workerebtables-translate -A FORWARD ! -i iname --logical-in ilogname -o out+ --logical-out lout+ -d 1:2:3:4:de:af 65*a71a9546SAutomerger Merge Workernft 'add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oifname "out*" meta obrname "lout*" ether daddr 01:02:03:04:de:af counter' 66*a71a9546SAutomerger Merge Worker 67*a71a9546SAutomerger Merge Workerebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00 68*a71a9546SAutomerger Merge Workernft 'insert rule bridge filter INPUT ether type 0x800 ether daddr and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter' 69*a71a9546SAutomerger Merge Worker 70*a71a9546SAutomerger Merge Workerebtables-translate -I INPUT -p Length 71*a71a9546SAutomerger Merge Workernft 'insert rule bridge filter INPUT ether type < 0x0600 counter' 72*a71a9546SAutomerger Merge Worker 73*a71a9546SAutomerger Merge Workerebtables-translate -I INPUT -p ! Length 74*a71a9546SAutomerger Merge Workernft 'insert rule bridge filter INPUT ether type >= 0x0600 counter' 75*a71a9546SAutomerger Merge Worker 76*a71a9546SAutomerger Merge Worker# asterisk is not special in iptables and it is even a valid interface name 77*a71a9546SAutomerger Merge Workeriptables-translate -A FORWARD -i * -o eth*foo 78*a71a9546SAutomerger Merge Workernft 'add rule ip filter FORWARD iifname "\*" oifname "eth*foo" counter' 79*a71a9546SAutomerger Merge Worker 80*a71a9546SAutomerger Merge Worker# escape only suffix asterisk and translate only the last plus character 81*a71a9546SAutomerger Merge Workeriptables-translate -A FORWARD -i eth*foo*+ -o eth++ 82*a71a9546SAutomerger Merge Workernft 'add rule ip filter FORWARD iifname "eth*foo**" oifname "eth+*" counter' 83*a71a9546SAutomerger Merge Worker 84*a71a9546SAutomerger Merge Worker# skip for always matching interface names 85*a71a9546SAutomerger Merge Workeriptables-translate -A FORWARD -i + 86*a71a9546SAutomerger Merge Workernft 'add rule ip filter FORWARD counter' 87*a71a9546SAutomerger Merge Worker 88*a71a9546SAutomerger Merge Worker# match against invalid interface name to simulate never matching rule 89*a71a9546SAutomerger Merge Workeriptables-translate -A FORWARD ! -i + 90*a71a9546SAutomerger Merge Workernft 'add rule ip filter FORWARD iifname "INVAL/D" counter' 91