nftables

func DeleteProxyChain ¶

func DeleteProxyChain() error

func EnsureKernelModules ¶

func EnsureKernelModules() error

EnsureKernelModules ensures that nft_tproxy kernel module is loaded.

func InsertProxyChain ¶

func InsertProxyChain(destPorts []uint16, redirectPort uint16, iface string) error

InsertProxyChain create a new nftables table with a single chain with a tproxy rule in it.

We create a new chain with a custom priority to ensure that we can cleanly add and remove it without affecting other rules or knowing the setup.

Generates a chain that looks like this:

table ip filter {
  chain tpuproxy {
    type filter hook prerouting priority -2147483648; policy accept;
    iifname "enp6s0" udp dport { 8003, 8004, 8005 } tproxy to :51211
  }
}