How to match destination ip with bridge devices by nftables?

0

I bridged eth0 and wlan0 together and I want to limit bandwidth when the packet's destination ip is 192.168.1.5 or 192.168.1.6 which is forward through wlan0. I add the following rules, but it is not working at all.

table ip filter {
    chain prerouting {
        type filter hook prerouting priority filter; policy accept;
        ip daddr { 192.168.1.5, 192.168.1.6 } meta mark set 0x00000002 counter packets 0 bytes 0
        ct mark set meta mark
    }

    chain input {
        type filter hook input priority filter; policy drop;
        tcp flags == 0x0 drop
        tcp flags & (fin | psh | urg) == fin | psh | urg drop
        tcp flags & (syn | ack) == syn | ack ct state new drop
        tcp dport { 22, 53, 139, 445 } accept
        udp dport { 53, 67, 137, 138 } accept
        ct state { established, related } accept
        iifname "lo" accept
    }
}

Questions:
1. How can I match dst ip when the NIC is a slave of a bridge?
2. Which interface should I create the htb on?

linux
networking
tc
nftables
asked on Server Fault Aug 5, 2019 by user762750

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0