{"id":107267,"date":"2023-03-14T12:48:14","date_gmt":"2023-03-14T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=107267"},"modified":"2023-03-15T19:12:55","modified_gmt":"2023-03-15T17:12:55","slug":"vypusk-paketnogo-filtra-nftables-1-0-7","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","title":{"rendered":"Udgivelse af den batchfiltrende nftables 1.0.7","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Udgivet er version 1.0.7 af pakkenetfiltrering nftables, der standardiserer filtreringsgr\u00e6nsefladerne for IPv4, IPv6, ARP og netv\u00e6rksbroer (rettet mod at erstatte iptables, ip6tables, arptables og ebtables). Pakken nftables indeholder komponenter til pakkenetfiltrering, der k\u00f8rer i brugerrummet, mens nf_tables subsystemet, som er en del af Linux-kernen siden version 3.13, h\u00e5ndterer arbejdet p\u00e5 kerneniveau. P\u00e5 kerneniveau leveres kun et generelt interface, der ikke afh\u00e6nger af den specifikke protokol, og som tilbyder grundl\u00e6ggende funktioner til dataudtr\u00e6k fra pakker, udf\u00f8relse af dataoperationer og flowkontrol.    <\/p>\n<p>Reglerne for filtrering og protokolspecifikke behandlere kompileres til bytekode i brugeromr\u00e5det, hvorefter denne bytekode indl\u00e6ses i kernen ved hj\u00e6lp af Netlink-interfacet og udf\u00f8res i kernen i en s\u00e6rlig <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/vps\/abuzoustojchivye-vps\/\"   title=\"virtuelle maskiner\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4335\">virtuelle maskiner<\/a>, der minder om BPF (Berkeley Packet Filters). Denne tilgang muligg\u00f8r en betydelig reduktion i st\u00f8rrelsen af den filtrering, der k\u00f8rer i kernen, og flytter alle funktioner til parsing af regler og logik til h\u00e5ndtering af protokoller til brugeromr\u00e5det.    <\/p>\n<p>Vigtige \u00e6ndringer:  <\/p>\n<ul>\n<li class=\"l\"> For systemer med Linux-kerne 6.2+ er der tilf\u00f8jet underst\u00f8ttelse af protokolmatchning for vxlan, geneve, gre og gretap, hvilket muligg\u00f8r brug af enkle udtryk til at tjekke overskrifter i indkapslede pakker. For eksempel kan man nu tjekke <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/lir\/ipv4\/\"   title=\"IP-adresser\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"711\">IP-adresser<\/a> I overskriften af den indlejrede VxLAN-pakke kan man nu bruge regler (uden behov for forudg\u00e5ende dekapsulering af VxLAN-overskriften og binding af filteret til gr\u00e6nsefladen vxlan0):          \u2026 udp dport 4789 vxlan ip protokol udp        \u2026 udp dport 4789 vxlan ip saddr 1.2.3.0\/24        \u2026 udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 }\n<li class=\"l\"> Underst\u00f8ttelse af automatisk sammensmeltning af rester efter delvis sletning af et element fra set-listen er blevet implementeret, hvilket g\u00f8r det muligt at fjerne et element eller en del af et interval fra et eksisterende interval (tidligere kunne intervallet kun slettes helt). For eksempel, efter at element 25 er slettet fra set-listen med intervallerne 24-30 og 40-50, vil listen best\u00e5 af 24, 26-30 og 40-50. Rettelser, der er n\u00f8dvendige for at g\u00f8re automatisk sammensmeltning funktionsdygtig, vil blive foresl\u00e5et i korrektioner til stabile kerneversioner 5.10+.              # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24-30, 40-50 }            }        }          # nft delete element ip x y { 25 }          # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24, 26-30, 40-50 }            }        }\n<li class=\"l\"> Brug af kontakttypen og intervaller er tilladt ved mappning af adresseovers\u00e6ttelse (NAT).      table ip nat {        chain prerouting {            type nat hook prerouting priority dstnat; policy accept;            dnat to ip daddr . tcp dport map { 10.1.1.136 . 80 : 1.1.2.69 . 1024,   10.1.1.10-10.1.1.20 . 8888-8889 : 1.1.2.69 . 2048-2049 } persistent       }    }\n<li class=\"l\"> St\u00f8tte for udtrykket \u00ablast\u00bb er tilf\u00f8jet, hvilket g\u00f8r det muligt at finde ud af, hvorn\u00e5r et regleelements eller set-listes sidste brug var. Muligheden underst\u00f8ttes fra Linux-kernens version 5.14.        tabel ip x {        s\u00e6t y {            typeof ip daddr . tcp dport            st\u00f8rrelse 65535            flags dynamisk,timeout            last            timeout 1h        }          k\u00e6de z {            type filter hook output prioritet filter; politik accept;            opdater @y { ip daddr . tcp dport }        }    }      # nft list set ip x y    tabel ip x {        s\u00e6t y {            typeof ip daddr . tcp dport            st\u00f8rrelse 65535            flags dynamisk,timeout            last            timeout 1h            elementer = { 172.217.17.14 . 443 sidst brugt 1s591ms timeout 1h udl\u00f8ber 59m58s409ms,                         172.67.69.19 . 443 sidst brugt 4s636ms timeout 1h udl\u00f8ber 59m55s364ms,                         142.250.201.72 . 443 sidst brugt 4s748ms timeout 1h udl\u00f8ber 59m55s252ms,                         172.67.70.134 . 443 sidst brugt 4s688ms timeout 1h udl\u00f8ber 59m55s312ms,                         35.241.9.150 . 443 sidst brugt 5s204ms timeout 1h udl\u00f8ber 59m54s796ms,                         138.201.122.174 . 443 sidst brugt 4s537ms timeout 1h udl\u00f8ber 59m55s463ms,                         34.160.144.191 . 443 sidst brugt 5s205ms timeout 1h udl\u00f8ber 59m54s795ms,                         130.211.23.194 . 443 sidst brugt 4s436ms timeout 1h udl\u00f8ber 59m55s564ms }           }    }\n<li class=\"l\"> Muligheden for at definere kvoter i set-lister er blevet tilf\u00f8jet. For eksempel, for at definere en kvote for trafik til hver m\u00e5l-IP-adresse, kan man angive:      tabel netdev x {        s\u00e6t y {            typeof ip daddr            st\u00f8rrelse 65535            kvote over 10000 mbytes        }          k\u00e6de y {            type filter hook egress enhed \u00abeth0\u00bb prioritet filter; politik accept;            ip daddr @y drop        }    }      # nft add element inet x y { 8.8.8.8 }    # ping -c 2 8.8.8.8       # nft list ruleset    tabel netdev x {        s\u00e6t y {            type ipv4_addr            st\u00f8rrelse 65535            kvote over 10000 mbytes            elementer = { 8.8.8.8 kvote over 10000 mbytes brugt 196 bytes }        }          k\u00e6de y {            type filter hook egress enhed \u00abeth0\u00bb prioritet filter; politik accept;            ip daddr @y drop        }    }\n<li class=\"l\"> The use of constants in set lists is allowed. For example, when using the destination address and VLAN identifier as the key for the list, you can directly specify the VLAN number (daddr . 123):          table netdev t {            set s {                typeof ether saddr . vlan id                size 2048                flags dynamic,timeout                timeout 1m            }              chain c {                type filter hook ingress device eth0 priority 0; policy accept;                ether type != 8021q update @s { ether daddr . 123 } counter            }        }\n<li class=\"l\"> Den nye kommando \u00abdestroy\u00bb er blevet tilf\u00f8jet for ubetinget at slette objekter (i mods\u00e6tning til kommandoen delete, som ikke genererer ENOENT ved fors\u00f8g p\u00e5 at slette et ikke-eksisterende objekt). For at fungere kr\u00e6ves mindst Linux-kernens version 6.3-rc.         destroy table ip filter        <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58791\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107267","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-14T10:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-15T17:12:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Udgivelse af nftables pakkefilter 1.0.7 | ProHoster","description":"The release of the nftables 1.0.7 packet filter has been published, unifying packet filtering interfaces for IPv4, IPv6, ARP, and network bridges (aimed at replacing iptables, ip6tables, arptables, and ebtables).","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-14T10:48:14+00:00","article:modified_time":"2023-03-15T17:12:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"107267","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:08","updated":"2026-02-08 20:24:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/107267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=107267"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/107267\/revisions"}],"predecessor-version":[{"id":164210,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/107267\/revisions\/164210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=107267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=107267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=107267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}