How to programmatically implement a firewall rule

How to programmatically implement a firewall rule

[Khawar Shehzad]

HI,
I hope all are fine, and happy new year.


I want to implement a rule using libnftnl in C programming. This rule
specifies that a packet with a specific source address and a specific
destination address SHOULD be allowed. All other packet which does not
have that source and destination address MUST be dropped.


Just a little hint would suffice. I need to implement it. Any
direction would be much appreciated.


Thanks,
Khawar

Re: How to programmatically implement a firewall rule

[Arturo Borrero Gonzalez]

On 5 January 2017 at 11:56, Khawar Shehzad <shehzad.khawar@gmail.com> wrote:
> HI,
> I hope all are fine, and happy new year.
>
>
> I want to implement a rule using libnftnl in C programming. This rule
> specifies that a packet with a specific source address and a specific
> destination address SHOULD be allowed. All other packet which does not
> have that source and destination address MUST be dropped.
>
>
> Just a little hint would suffice. I need to implement it. Any
> direction would be much appreciated.

Take a look at libnftnl examples. In nft-rule-add.c [0] a rule that
does 'tcp dport 22 counter' is added.

[0] http://git.netfilter.org/libnftnl/tree/examples/nft-rule-add.c

Re: How to programmatically implement a firewall rule

[Khawar Shehzad]

On Thu, Jan 5, 2017 at 5:02 PM, Jehan Tremback <jehan@altheamesh.com> wrote:
> altheamesh.com

Performance. In my case the rules get updated very often, and a lot of
rules get configured per second. So it all boils down to performance
for me.