0

I want to create an nftables filter rule that drops traffic where the source and destination address are equal. Nftables only allows to compare addresses against constants or sets/maps. So I tried to add the destination address to a map and then compare the source address against the map.

I tried:

table inet my_table {
  map srcdest { type ipv4_addr: ipv4_addr; }
  chain my_chain {
    meta nfproto ipv4 update @srcdest { ip saddr : ip daddr }
    meta nfproto ipv4 ip saddr ip saddr map @srcdest drop
  }
}

but get a syntax error, unexpected drop at the drop in the last line.

I was expecting that

ip saddr map @srcdest

would perform a lookup of the source address in the map and return the destination address, so the line would translate to something like:

meta nfproto ipv4 ip saddr 192.168.1.1 drop

0

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.