On Thu, Jun 20, 2019 at 09:17:40AM +0800, we...@ucloud.cn wrote:
> From: wenxu <we...@ucloud.cn>
>
> nft add table bridge firewall
> nft add chain bridge firewall zones { type filter hook prerouting priority -
> 300 \; }
> nft add rule bridge firewall zones counter ct zone set vlan id map { 100 : 1,
> 200 : 2 }
>
> As above set the bridge port with pvid, the received packet don't contain
> the vlan tag which means the packet should belong to vlan 200 through pvid.
> With this pacth user can set the pvid in the prerouting hook before set zone
> id and conntrack.
>
> So add the following rule for as the first rule in the chain of zones.
>
> nft add rule bridge firewall zones counter meta brvlan set meta brpvid
Also applied, thanks.
