{"id":38916,"date":"2019-10-31T22:26:43","date_gmt":"2019-10-31T19:26:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-debian-11-predlagaetsya-po-umolchaniyu-zadejstvovat-nftables-i-firewalld\/"},"modified":"2019-10-31T22:26:43","modified_gmt":"2019-10-31T19:26:43","slug":"v-debian-11-predlagaetsya-po-umolchaniyu-zadejstvovat-nftables-i-firewalld","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-debian-11-predlagaetsya-po-umolchaniyu-zadejstvovat-nftables-i-firewalld","title":{"rendered":"V Debianu 11 je v\u00fdchoz\u00ed mo\u017enost\u00ed aktivovat nftables a firewalld","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Arturo Borrero, v\u00fdvoj\u00e1\u0159 Debianu, \u010dlen Coreteam projektu Netfilter a spr\u00e1vce bal\u00ed\u010dk\u016f souvisej\u00edc\u00edch s nftables, iptables a netfilter v Debianu, navrhl<\/a><\/noindex> navrhl p\u0159ej\u00edt v p\u0159\u00ed\u0161t\u00edm v\u00fdznamn\u00e9m vyd\u00e1n\u00ed distribuce Debian 11 na pou\u017e\u00edv\u00e1n\u00ed nftables jako v\u00fdchoz\u00edho. V p\u0159\u00edpad\u011b schv\u00e1len\u00ed n\u00e1vrhu budou bal\u00ed\u010dky s iptables p\u0159e\u0159azeny do kategorie voliteln\u00fdch mo\u017enost\u00ed, kter\u00e9 nejsou zahrnuty v z\u00e1kladn\u00ed dod\u00e1vce.<\/p>\n

Bal\u00ed\u010dkov\u00fd filtr Nftables se vyzna\u010duje unifikac\u00ed filtr\u016f pro IPv4, IPv6, ARP a s\u00ed\u0165ov\u00e9 mosty. Nftables poskytuje na \u00farovni j\u00e1dra pouze obecn\u00e9 rozhran\u00ed, kter\u00e9 nez\u00e1vis\u00ed na konkr\u00e9tn\u00edm protokolu a nab\u00edz\u00ed z\u00e1kladn\u00ed funkce pro extrakci dat z paket\u016f, prov\u00e1d\u011bn\u00ed operac\u00ed s daty a \u0159\u00edzen\u00ed toku. Logika filtrov\u00e1n\u00ed a specifick\u00e9 protokoly se kompiluj\u00ed do bajtk\u00f3du ve u\u017eivatelsk\u00e9m prostoru, kter\u00fd je pak nahr\u00e1n do j\u00e1dra pomoc\u00ed rozhran\u00ed Netlink a prov\u00e1d\u00ed se ve speci\u00e1ln\u00ed virtu\u00e1ln\u00ed stroji podobn\u00e9 BPF (Berkeley Packet Filters). <\/p>\n

Ve v\u00fdchoz\u00edm nastaven\u00ed je v Debianu 11 tak\u00e9 navr\u017eeno pou\u017e\u00edvat dynamickou br\u00e1nu firewall firewalld, kter\u00e1 funguje jako obal nad nftables. Firewalld b\u011b\u017e\u00ed jako proces na pozad\u00ed, co\u017e umo\u017e\u0148uje dynamicky m\u011bnit pravidla filtru paket\u016f p\u0159es DBus, ani\u017e by bylo nutn\u00e9 restartovat pravidla filtru a bez p\u0159eru\u0161en\u00ed existuj\u00edc\u00edch spojen\u00ed. Pro spr\u00e1vu br\u00e1ny firewall se pou\u017e\u00edv\u00e1 utilita firewall-cmd, kter\u00e1 p\u0159i vytv\u00e1\u0159en\u00ed pravidel vych\u00e1z\u00ed ne z IP adress<\/a>, s\u00ed\u0165ov\u00fdch rozhran\u00ed a \u010d\u00edsel port\u016f, ale od n\u00e1zv\u016f slu\u017eeb (nap\u0159\u00edklad pro povolen\u00ed p\u0159\u00edstupu k SSH je t\u0159eba prov\u00e9st «firewall-cmd —add —service=ssh», pro zak\u00e1z\u00e1n\u00ed SSH — «firewall-cmd —remove —service=ssh»).<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0440\u0442\u0443\u0440\u043e \u0411\u043e\u0440\u0440\u0435\u0440\u043e (Arturo Borrero), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 Coreteam \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Netfilter \u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0439 \u0432 Debian \u043f\u0430\u043a\u0435\u0442\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 nftables, iptables \u0438 netfilter, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0435\u0440\u0435\u0432\u0435\u0441\u0442\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Debian 11 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 nftables \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u044b \u0441 iptables \u0431\u0443\u0434\u0443\u0442 \u043f\u0435\u0440\u0435\u0432\u0435\u0434\u0435\u043d\u044b \u0432 \u0440\u0430\u0437\u0440\u044f\u0434 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u043f\u0446\u0438\u0439, \u043d\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0432 \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443. \u041f\u0430\u043a\u0435\u0442\u043d\u044b\u0439 \u0444\u0438\u043b\u044c\u0442\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38916","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V Debianu 11 je v\u00fdchoz\u00ed mo\u017enost\u00ed aktivovat nftables a firewalld | ProHoster","description":"Arturo Borrero, v\u00fdvoj\u00e1\u0159 Debianu, \u010dlen Coreteam projektu Netfilter a spr\u00e1vce bal\u00ed\u010dk\u016f souvisej\u00edc\u00edch s nftables, iptables a netfilter v Debianu,","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-debian-11-predlagaetsya-po-umolchaniyu-zadejstvovat-nftables-i-firewalld","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Debian 11 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c nftables \u0438 firewalld | ProHoster","og:description":"\u0410\u0440\u0442\u0443\u0440\u043e \u0411\u043e\u0440\u0440\u0435\u0440\u043e (Arturo Borrero), \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a Debian, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 Coreteam \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Netfilter \u0438 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0439 \u0432 Debian \u043f\u0430\u043a\u0435\u0442\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 nftables, iptables \u0438 netfilter,","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-debian-11-predlagaetsya-po-umolchaniyu-zadejstvovat-nftables-i-firewalld","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:26:43+00:00","article:modified_time":"2019-10-31T19:26:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38916","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:44:57","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:00:27","updated":"2026-02-08 20:44:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38916","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38916"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38916\/revisions"}],"predecessor-version":[{"id":157996,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38916\/revisions\/157996"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38916"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38916"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38916"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}