Setting packet metainformation - Revision history

Fmyhr: Added pkttype section. Moved intro description of keywords to the appropriate sections.

2021-04-16T17:33:32Z

Added pkttype section. Moved intro description of keywords to the appropriate sections.

← Older revision		Revision as of 17:33, 16 April 2021
Line 1:		Line 1:
	You can set some [[Matching_packet_metainformation \|metainformation]] in a packet. ~~Current supported options are:~~		You can set some [[Matching_packet_metainformation \|metainformation]] in a packet. Please note that you require a Linux kernel >= 3.14 to use these features.
	* mark -- packet mark
	* priority -- packet priority
	* nftrace -- [[Ruleset_debug/tracing\|nftrace debugging]] bit
	* pkttype -- packet type
	* secmark -- packet secmark

	~~Please note that you require a Linux kernel >= 3.14 to use these features.~~		== packet mark ==

	== mark ==
	The following example shows how to set the packet mark:		The following example shows how to set the packet mark:

Line 16:		Line 9:


	== mark and conntrack mark ==		== packet mark and conntrack mark ==

	You can save/restore conntrack mark like in iptables.		You can save/restore conntrack mark like in iptables.
Line 34:		Line 27:


	== secmark ==		== packet secmark ==
	* You can use [[Secmark\|secmark objects]] to set [https://selinuxproject.org/page/NB_Networking#SECMARK SECMARK] labels on packets.		* You can use [[Secmark\|secmark objects]] to set [https://selinuxproject.org/page/NB_Networking#SECMARK SECMARK] labels on packets.

Line 43:		Line 36:


	== priority ==		== packet priority ==
	You can set the priority of a packet.		You can set the priority of a packet.

Line 58:		Line 51:


	== nftrace ==		== ''pkttype'' ==

			You can set the [[Data_types#Other_types\|packet type]]:
			<source>
			meta pkttype set {pkt_type}
			</source>


			== ''nftrace'' ==

	Setting nftrace in a packet will report the journey through the nf_tables stack.		Setting the [[Ruleset_debug/tracing\|''nftrace'' debugging bit]] in a packet will report the journey through the nf_tables stack:

	<source lang="bash">		<source lang="bash">

Fmyhr: secmark: link secmark object page

2021-04-16T17:09:28Z

secmark: link secmark object page

← Older revision		Revision as of 17:09, 16 April 2021
Line 35:		Line 35:

	== secmark ==		== secmark ==
	New in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3], you can set the packet secmark from its associated [[Setting_packet_connection_tracking_metainformation#ct_secmark_set_-_Set_conntrack_secmark_from_packet_secmark\|conntrack secmark]]:		* You can use [[Secmark\|secmark objects]] to set [https://selinuxproject.org/page/NB_Networking#SECMARK SECMARK] labels on packets.

			* New in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3], you can set the packet secmark from its associated [[Setting_packet_connection_tracking_metainformation#ct_secmark_set_-_Set_conntrack_secmark_from_packet_secmark\|conntrack secmark]]:
	<source>		<source>
	meta secmark set ct secmark		meta secmark set ct secmark

Fmyhr: Added secmark section, showing how to set packet secmark from conntrack secmark.

2021-04-16T17:00:53Z

Added secmark section, showing how to set packet secmark from conntrack secmark.

← Older revision		Revision as of 17:00, 16 April 2021
Line 14:		Line 14:
	% nft add rule route output mark set 123		% nft add rule route output mark set 123
	</source>		</source>


	== mark and conntrack mark ==		== mark and conntrack mark ==
Line 31:		Line 32:
	% nft add rule filter forward meta mark set ct mark		% nft add rule filter forward meta mark set ct mark
	</source>		</source>


			== secmark ==
			New in [https://marc.info/?l=netfilter&m=157532146917292&w=2 nftables 0.9.3], you can set the packet secmark from its associated [[Setting_packet_connection_tracking_metainformation#ct_secmark_set_-_Set_conntrack_secmark_from_packet_secmark\|conntrack secmark]]:
			<source>
			meta secmark set ct secmark
			</source>


	== priority ==		== priority ==
Line 45:		Line 54:

	'''Warning''': There is a bug in the priority syntax that will be fixed in following versions of nftables.		'''Warning''': There is a bug in the priority syntax that will be fixed in following versions of nftables.


	== nftrace ==		== nftrace ==
Line 53:		Line 63:
	% nft add rule filter forward udp dport 53 meta nftrace set 1		% nft add rule filter forward udp dport 53 meta nftrace set 1
	</source>		</source>


	== combination of options ==		== combination of options ==

Arturo: add nftrace wiki link

2019-12-17T09:45:40Z

add nftrace wiki link

← Older revision		Revision as of 09:45, 17 December 2019
Line 2:		Line 2:
	* mark -- packet mark		* mark -- packet mark
	* priority -- packet priority		* priority -- packet priority
	* nftrace -- nftrace debugging bit		* nftrace -- [[Ruleset_debug/tracing\|nftrace debugging]] bit
	* pkttype -- packet type		* pkttype -- packet type
	* secmark -- packet secmark		* secmark -- packet secmark

Arturo: refresh introductory paragraph

2019-12-17T09:43:57Z

refresh introductory paragraph

← Older revision		Revision as of 09:43, 17 December 2019
Line 1:		Line 1:
	You can set some metainformation in a packet: ~~one of~~ mark, priority or nftrace.		You can set some [[Matching_packet_metainformation \|metainformation]] in a packet. Current supported options are:
			* mark -- packet mark
			* priority -- packet priority
			* nftrace -- nftrace debugging bit
			* pkttype -- packet type
			* secmark -- packet secmark

	Please note that you require a Linux kernel >= 3.14 to use these features.		Please note that you require a Linux kernel >= 3.14 to use these features.

Mate: /* mark and conntrack mark */ fixed mark setting example

2018-05-04T22:03:05Z

mark and conntrack mark: fixed mark setting example

← Older revision		Revision as of 22:03, 4 May 2018
Line 18:		Line 18:

	<source lang="bash">		<source lang="bash">
	% nft add rule filter forward meta mark 1		% nft add rule filter forward meta mark set 1
	% nft add rule filter forward ct mark set mark		% nft add rule filter forward ct mark set mark
	</source>		</source>

Pablo: Created page with "You can set some metainformation in a packet: one of mark, priority or nftrace. Please note that you require a Linux kernel >= 3.14 to use these features. == mark == The fol..."

2016-07-13T17:58:00Z

Created page with "You can set some metainformation in a packet: one of mark, priority or nftrace. Please note that you require a Linux kernel >= 3.14 to use these features. == mark == The fol..."

New page

You can set some metainformation in a packet: one of mark, priority or nftrace.

Please note that you require a Linux kernel >= 3.14 to use these features.

== mark ==
The following example shows how to set the packet mark:

<source lang="bash">
% nft add rule route output mark set 123
</source>

== mark and conntrack mark ==

You can save/restore conntrack mark like in iptables.

In this example, the nf_tables engine set the packet mark to 1.
In the last rule, that mark is store in the conntrack entry associated with the flow:

<source lang="bash">
% nft add rule filter forward meta mark 1
% nft add rule filter forward ct mark set mark
</source>

In this example, the conntrack mark is stored in the packet.
<source lang="bash">
% nft add rule filter forward meta mark set ct mark
</source>

== priority ==
You can set the priority of a packet.

This example shows a similar operation to what "-j CLASSIFY" does in iptables:

<source lang="bash">
% nft add table mangle
% nft add chain postrouting {type route hook output priority -150\; }
% nft add rule mangle postrouting tcp sport 80 meta priority set 1
</source>

'''Warning''': There is a bug in the priority syntax that will be fixed in following versions of nftables.

== nftrace ==

Setting nftrace in a packet will report the journey through the nf_tables stack.

<source lang="bash">
% nft add rule filter forward udp dport 53 meta nftrace set 1
</source>

== combination of options ==

Given the flexible design of nftables, remember you can perform several actions to a packet in one rule:

<source lang="bash">
% nft add rule filter forward ip saddr 192.168.1.1 meta nftrace set 1 meta priority set 2 meta mark set 123
</source>