netfilter

package

Go to main page

Versions in this module

v0

v0.0.7

Oct 27, 2026

Changes in this version

+ const LogPrefixMarker

+ const LogSnaplen

+ const TagDefault

+ const TagKindBlock

+ const TagKindDeny

+ const TagKindMetadata

+ const TagKindTranslation

+ func LogPrefix(fingerprint, tag string) (string, error)

+ func ParseLogPrefix(s string) (fingerprint, tag string, ok bool)

+ func ParseTag(tag string) (kind string, prefix netip.Prefix, ok bool)

type Input

+ DropDenied bool

+ type LogOptions struct

+ Fingerprint string

+ Group uint16

type NftablesOptions

+ Log *LogOptions

type Policy

+ DropDenied bool

type Rule

+ Tag string

v0.0.6

Oct 16, 2026

v0.0.5

Oct 12, 2026

Changes in this version

type Blocked

+ Metadata bool

+ Translation bool

type Input

+ DenyCIDRs []netip.Prefix

type Rule

+ Carve bool

+ Denied bool

v0.0.4

Sep 27, 2026

v0.0.3

Sep 27, 2026

v0.0.2

Sep 17, 2026

Changes in this version

type Input

+ AllowAllPorts bool

v0.0.1

Sep 13, 2026

Changes in this version

+ const MaxPorts

+ const MaxPrefixes

+ var ErrUnavailable = errors.New("netfilter: host packet filtering is unavailable")

+ func BlockReasonForPrefix(p netip.Prefix) string

+ func RenderNftables(p Policy, opts NftablesOptions) (string, error)

+ func TableName(prefix, id string) string

+ func ValidateInterfaceName(name string) error

+ func ValidateNftName(name string) error

+ type Applier struct

+ func NewApplier() (*Applier, error)

+ func (a *Applier) Apply(ctx context.Context, p Policy, opts NftablesOptions) error

+ func (a *Applier) Available(ctx context.Context) error

+ func (a *Applier) Path() string

+ func (a *Applier) Remove(ctx context.Context, table string) error

+ type Blocked struct

+ Prefix netip.Prefix

+ Reason string

+ func BlockedPrefixes() []Blocked

+ type IPBlock struct

+ CIDR string

+ Except []string

+ type Input struct

+ AllowCIDRs []netip.Prefix

+ AllowPorts []uint16

+ AllowPublicInternet bool

+ Brokers []netip.AddrPort

+ HostPatterns []string

+ Resolvers []netip.AddrPort

+ type LabelSelector struct

+ MatchLabels map[string]string

+ type Mode uint8

+ const ModeBrokered

+ const ModeFiltered

+ const ModeIsolated

+ func (m Mode) String() string

+ type NetworkPolicy struct

+ APIVersion string

+ Kind string

+ Metadata NetworkPolicyMeta

+ Spec NetworkPolicySpec

+ func RenderNetworkPolicy(p Policy, opts NetworkPolicyOptions) (*NetworkPolicy, error)

+ type NetworkPolicyMeta struct

+ Annotations map[string]string

+ Labels map[string]string

+ Name string

+ Namespace string

+ type NetworkPolicyOptions struct

+ AllowClusterDNS bool

+ Annotations map[string]string

+ DNSNamespaceLabels map[string]string

+ Labels map[string]string

+ Name string

+ Namespace string

+ PodSelector map[string]string

+ type NetworkPolicyPeer struct

+ IPBlock *IPBlock

+ NamespaceSelector *LabelSelector

+ PodSelector *LabelSelector

+ type NetworkPolicyPort struct

+ Port *int

+ Protocol string

+ type NetworkPolicyRule struct

+ From []NetworkPolicyPeer

+ Ports []NetworkPolicyPort

+ To []NetworkPolicyPeer

+ type NetworkPolicySpec struct

+ Egress []NetworkPolicyRule

+ Ingress []NetworkPolicyRule

+ PodSelector LabelSelector

+ PolicyTypes []string

+ type NftablesOptions struct

+ Bridge string

+ Table string

+ type Policy struct

+ Mode Mode

+ Rules []Rule

+ Warnings []string

+ func Compile(in Input) (Policy, error)

+ func (p Policy) Evaluate(addr netip.Addr, port uint16, proto Proto) (Verdict, string)

+ func (p Policy) WireOnly() Policy

+ type Proto uint8

+ const ProtoAny

+ const ProtoTCP

+ const ProtoUDP

+ func (p Proto) String() string

+ type Rule struct

+ Ports []uint16

+ Prefix netip.Prefix

+ Proto Proto

+ Reason string

+ Scope Scope

+ Verdict Verdict

+ func (r Rule) String() string

+ type Scope uint8

+ const ScopeLocal

+ const ScopeWire

+ type Verdict uint8

+ const VerdictAllow

+ const VerdictDrop

+ func (v Verdict) String() string

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL