3

Let's say I want to apply a rule to ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }, but I want to exclude two more specific IPv4 addresses from that. How do I do that?

I was hoping for some more elegant way of doing this:

ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } \ ip daddr != 10.0.1.2 \ ip daddr != 10.0.2.3

as explained in the nft manpage for negation of addresses or ranges, but it does not show a way to do that with sets.

Improve this question
1

1 Answer 1

Reset to default
7

It appears that negations of sets are working as expected (undocumented):

ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } \ ip daddr != { 10.0.1.2, 10.0.2.3 }
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.