add VYATTA_CT_PREROUTING_HOOK for flow statistics

5 years ago · 082cdd1f0c
parent cac2f9a599
commit 082cdd1f0c
2 changed files with 10 additions and 0 deletions
--- a/bcp38.iptables.v4
+++ b/bcp38.iptables.v4
@ -9,7 +9,12 @@ COMMIT
 *raw
 :PREROUTING ACCEPT [0:0]
 :OUTPUT ACCEPT [0:0]
+:VYATTA_CT_PREROUTING_HOOK - [0:0]
 -A PREROUTING -j NOTRACK
+{% for iface_name, iface_data in pillar['netbox']['interfaces'].items() %}{% if salt['pillar.get']('interfaces:'+iface_name+':netflow') %}
+-A PREROUTING -i {{ iface_name }} -j NFLOG --nflog-group 2 --nflog-range 64 --nflog-threshold 10
+-A VYATTA_CT_PREROUTING_HOOK -i {{ iface_name }} -j NFLOG --nflog-group 2 --nflog-range 64 --nflog-threshold 10
+{% endif %}{% endfor %}
 COMMIT

 *nat
--- a/bcp38.iptables.v6
+++ b/bcp38.iptables.v6
@ -9,7 +9,12 @@ COMMIT
 *raw
 :PREROUTING ACCEPT [0:0]
 :OUTPUT ACCEPT [0:0]
+:VYATTA_CT_PREROUTING_HOOK - [0:0]
 -A PREROUTING -j NOTRACK
+{% for iface_name, iface_data in pillar['netbox']['interfaces'].items() %}{% if salt['pillar.get']('interfaces:'+iface_name+':netflow') %}
+-A PREROUTING -i {{ iface_name }} -j NFLOG --nflog-group 2 --nflog-range 64 --nflog-threshold 10
+-A VYATTA_CT_PREROUTING_HOOK -i {{ iface_name }} -j NFLOG --nflog-group 2 --nflog-range 64 --nflog-threshold 10
+{% endif %}{% endfor %}
 COMMIT

 *nat