Documentation > Userspace Clients > denylist4 Mode

denylist4 Mode

Index

  1. Description
  2. Syntax
  3. Arguments
    1. Operations
    2. Options
  4. Examples

Description

Interacts with Jool’s denylist address pool.

The pool lists IPv4 translation addresses which are banned from pool6-based translation. If an incoming IPv4 packet contains one of these addresses (which would be translated via pool6 and not the EAMT), Jool will silently abort translation. If an incoming IPv6 packet translates (through pool6) into an IPv4 packet that contains one of these addresses, Jool will also silently abort translation.

denylist4 applies on most addresses. The only exception is source addresses from ICMP errors. These are translated regardless of denylist4 for the sake of troubleshooting purposes.

As an aside, there are some addresses Jool will refuse to translate, regardless of denylist4. These include

  • The addresses that belong to Jool’s node (because Jool can only be used in a forwarding fashion, currently).
  • Software addresses (0.0.0.0/8).
  • Host addresses (127.0.0.0/8).
  • Link-local addresses (169.254.0.0/16).
  • Multicast addresses (224.0.0.0/4).
  • Limited broadcast (255.255.255.255/32).

The denylist is mostly only relevant in Netfilter Jool, because iptables Jool already has matching conditionals by nature.

Note! Before Jool 4.1.4, denylist4 used to be called “blacklist4.” The latter still works, but is considered a deprecated alias.

Syntax

jool_siit denylist4 (
	display [--csv]
	| add <IPv4-prefix>
	| remove <IPv4-prefix>
	| flush
)

Arguments

Operations

  • display: The pool’s addresses/prefixes are printed in standard output.
  • add: Uploads <IPv4-prefix> to the pool.
  • remove: Deletes <IPv4-prefix> from the pool.
  • flush: Removes all addresses/prefixes from the pool.

<IPv4-prefix>’s prefix length defaults to 32.

Options

Flag Description
--csv Print the table in Comma/Character-Separated Values format. This is intended to be redirected into a .csv file.

Examples

These examples assume that the name of the Jool instance is “default.”

Add addresses:

# jool_siit denylist4 add 192.0.2.0/28
# jool_siit denylist4 add 198.51.100.0/30
# jool_siit denylist4 add 203.0.113.8/32

Display the current addresses:

# jool_siit denylist4 display
+--------------------+
|        IPv4 Prefix |
+--------------------+
|       192.0.2.0/28 |
|    198.51.100.0/30 |
|     203.0.113.8/32 |
+--------------------+

Remove an entry:

# jool_siit denylist4 remove 198.51.100.0/30

Clear the table:

# jool_siit denylist4 flush