Translation for iptables raw rules that targert rtsp / Conntrack helper,

Laurent ARNAL <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
Hello all,

I've setup nf_nat_rtsp / nf_conntrack_rtsp to handle iptv flow from my 
internet provider.
This now work ok, but to make it work correctly, I need a rule like this 
one in the firewall:

     iptables-nft -t raw -A PREROUTING -p tcp --dport 554 -j CT --helper 
rtsp

So If Issue this command, everything is working of.
The matter is that I don't know how to translate it to put in my 
firewall.nft file.

nft list ruleset give me something like:

# Warning: table ip raw is managed by iptables-nft, do not touch!
table ip raw {
         chain PREROUTING {
                 type filter hook prerouting priority raw; policy accept;
                 tcp dport 554 counter packets 0 bytes 0 xt target "CT"
         }
}

If i put something like

table ip raw {
         chain PREROUTING {
                 tcp dport 554 -j "CT"
                 tcp dport 554 counter xt target "CT";
         }
}


I've got an error on loading:

nft flush ruleset; nft -f /etc/nftables/main.nft
     /etc/nftables/main.nft:380:27-40: Error: unsupported xtables compat 
expression, use iptables-nft with this ruleset
       tcp dport 554 counter xt target "CT";

I've also try the following syntax:

table ip raw {
         chain PREROUTING {
                 type filter hook prerouting priority raw; policy accept;
                 tcp dport 554 counter ct helper rtsp;
         }

}

This is loading ok, but have no effect.
Can someone point me the good way to target the rtsp conntrack from 
nftables ?

Thanks,

        Laurent.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.