Nft rule for TTL mangling

[dave14305]

Not supported today in nftables.

Firewall4 / NFtables Tips and Tricks

# /etc/nftables.d/90-mangle-ttl.nft chain mangle_ttl_out { type filter hook postrouting priority mangle; meta nfproto ipv4 oifname eth2 ip ttl set 64 } chain mangle_ttl_in { type filter hook prerouting priority mangle; meta nfproto ipv4 iifname eth2 ip ttl 1 ip ttl set 5 } Notes: If you want to treat IPv6 as well, remove the meta nfproto ipv4 part. nftables does not support an equivalent to iptables' --ttl-inc yet, but since "match ttl 1, increment by 4" is just a static rew…