Для создания правила маркировки сетевого трафика на основе сетевого порта источника для протокола tcp/udp необходимо выполнить команду «nft add rule ip filter smark <tcp/udp> sport <номер порта> ip dscp set <dscp number> accept»:
# nft add rule ip filter smark tcp sport 22 ip dscp set cs7 accept
# nft add rule ip filter smark udp sport 22 ip dscp set af41 accept
#
# nft list ruleset
table ip filter {
chain input {
type filter hook input priority 30; policy accept;
}
chain forward {
type filter hook forward priority 30; policy accept;
}
chain output {
type filter hook output priority 30; policy accept;
}
chain smark {
type filter hook forward priority filter; policy accept;
tcp sport 22 ip dscp set cs7 accept
udp sport 22 ip dscp set af41 accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 30; policy accept;
}
chain postrouting {
type nat hook postrouting priority 30; policy accept;
}
}
Для создания правила маркировки сетевого трафика на основе группы сетевых портов источника для протокола tcp/udp необходимо выполнить команду «nft add rule ip filter smark <tcp/udp> sport {<номера портов>} ip dscp set <dscp number> accept»:
# nft add rule ip filter smark tcp sport {22, 443, 23, 74} ip dscp set af11 accept
# nft add rule ip filter smark udp sport {22, 443, 23, 74} ip dscp set cs7 accept
#
# nft list ruleset
table ip filter {
chain input {
type filter hook input priority 30; policy accept;
}
chain forward {
type filter hook forward priority 30; policy accept;
}
chain output {
type filter hook output priority 30; policy accept;
}
chain smark {
type filter hook forward priority filter; policy accept;
tcp sport { 22, 23, 74, 443 } ip dscp set af11 accept
udp sport { 22, 23, 74, 443 } ip dscp set cs7 accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 30; policy accept;
}
chain postrouting {
type nat hook postrouting priority 30; policy accept;
}
}
Для создания правила маркировки сетевого трафика на основе сетевого порта назначения для протокола tcp/udp необходимо выполнить команду «nft add rule ip filter smark <tcp/udp> dport <номер порта> ip dscp set <dscp number> accept»:
# nft add rule ip filter smark tcp dport 22 ip dscp set cs7 accept
# nft add rule ip filter smark udp dport 22 ip dscp set af11 accept
#
# nft list ruleset
table ip filter {
chain input {
type filter hook input priority 30; policy accept;
}
chain forward {
type filter hook forward priority 30; policy accept;
}
chain output {
type filter hook output priority 30; policy accept;
}
chain smark {
type filter hook forward priority filter; policy accept;
tcp dport 22 ip dscp set cs7 accept
udp dport 22 ip dscp set af11 accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 30; policy accept;
}
chain postrouting {
type nat hook postrouting priority 30; policy accept;
}
}
Для создания правила маркировки сетевого трафика на основе группы сетевых портов назначения для протокола tcp/udp необходимо выполнить команду «nft add rule ip filter smark <tcp/udp> sport {<номера портов>} ip dscp set <dscp number> accept»:
# nft add rule ip filter smark tcp dport {22, 443, 23, 74} ip dscp set af11 accept
# nft add rule ip filter smark udp dport {22, 443, 23, 74} ip dscp set cs7 accept
#
# nft list ruleset
table ip filter {
chain input {
type filter hook input priority 30; policy accept;
}
chain forward {
type filter hook forward priority 30; policy accept;
}
chain output {
type filter hook output priority 30; policy accept;
}
chain smark {
type filter hook forward priority filter; policy accept;
tcp dport { 22, 23, 74, 443 } ip dscp set af11 accept
udp dport { 22, 23, 74, 443 } ip dscp set cs7 accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 30; policy accept;
}
chain postrouting {
type nat hook postrouting priority 30; policy accept;
}
}