{"id":150734,"date":"2025-12-05T23:12:01","date_gmt":"2025-12-05T21:12:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-1-6"},"modified":"2025-12-05T23:12:01","modified_gmt":"2025-12-05T21:12:01","slug":"vypusk-paketnogo-filtra-nftables-1-1-6","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-1-6","title":{"rendered":"Ver\u00f6ffentlichung des Paketfilters nftables 1.1.6","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Die Ver\u00f6ffentlichung des Paketfilters nftables 1.1.6 wurde bekannt gegeben, der die Schnittstellen f\u00fcr die Paketfilterung von IPv4, IPv6, ARP und Netzwerkbr\u00fccken vereinheitlicht (zielt darauf ab, iptables, ip6table, arptables und ebtables zu ersetzen). Gleichzeitig wurde auch die Ver\u00f6ffentlichung der zugeh\u00f6rigen Bibliothek libnftnl 1.3.1 bekannt gegeben, die eine Low-Level-API f\u00fcr die Interaktion mit dem nf_tables-System bereitstellt.           <\/p>\n<p>Das Paket nftables umfasst Komponenten des Paketfilters, die im Benutzermodus arbeiten, w\u00e4hrend auf Kernel-Ebene das Subsystem nf_tables, das seit Version 3.13 Teil des Linux-Kernels ist, die Arbeit bereitstellt. Auf Kernel-Ebene wird nur eine allgemeine Schnittstelle bereitgestellt, die unabh\u00e4ngig vom spezifischen Protokoll ist und grundlegende Funktionen zum Extrahieren von Daten aus Paketen, Ausf\u00fchren von Datenoperationen und Steuern des Flusses bietet.    <\/p>\n<p>Die eigentlichen Filterregeln und protokollspezifischen Handler werden im Benutzermodus in Bytecode kompiliert, danach wird dieser Bytecode \u00fcber die Netlink-Schnittstelle in den Kernel geladen und dort in einem speziellen <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/de\/vps\/abuzoustojchivye-vps\/\"   title=\"virtuellen Maschine\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4362\">virtuellen Maschine<\/a>, der an BPF (Berkeley Packet Filters) erinnert, ausgef\u00fchrt. Dieser Ansatz erm\u00f6glicht es, die Gr\u00f6\u00dfe des im Kernel arbeitenden Filtercodes erheblich zu reduzieren und alle Funktionen zur Regel-Parsing und zur Logik der Protokollverarbeitung in den Benutzermodus auszulagern.    <\/p>\n<p>Haupt\u00e4nderungen:  <\/p>\n<ul>\n<li class=\"l\"> Vollst\u00e4ndige Unterst\u00fctzung f\u00fcr leichte Tunnelvorlagen wie vxlan, geneve und erspan ist gew\u00e4hrleistet:           table netdev global {                tunnel t1 {                        id 10                        ip saddr 192.168.2.10                        ip daddr 192.168.2.11                        sport 1025                        dport 20020                        ttl 1                        erspan {                                version 1                                index 2                        }                }                   tunnel t2 {                        id 10                        ip saddr 192.168.3.10                        ip daddr 192.168.3.11                        sport 1025                        dport 21021                        ttl 1                        erspan {                                version 1                                index 2                        }                }                     chain in {                        type filter hook ingress device veth0 priority 0;                              tunnel name ip saddr map { 10.141.10.12 : 't1',   10.141.10.13 : 't2' } fwd to erspan1                }         }    Vor dem Laden der Regeln muss das Netzwerkinterface erspan1 erstellt werden:     ip link add dev erspan1 type erspan external\n<li class=\"l\"> Unterst\u00fctzung f\u00fcr Masken in den Namen von Netzwerkinterfaces in den netdev-Handlern hinzugef\u00fcgt, z.B. um eine Basis-Kette f\u00fcr die Filterung des eingehenden Traffics f\u00fcr alle vlan-Ger\u00e4te hinzuzuf\u00fcgen, kann angegeben werden:           table netdev t {                chain c {                        type filter hook ingress devices = { 'vlan*', 'veth0' }   priority filter; policy accept;                }         }\n<li class=\"l\"> Auf Systemen mit dem Linux-Kernel 6.18+ wurde die Unterst\u00fctzung des Transports von L2-Frames \u00fcber Netzwerkbr\u00fcckeninterfacen zur lokalen Verarbeitung implementiert, zum Beispiel, um alle Ethernet-Frames f\u00fcr die MAC-Adresse de:ad:00:00:be:ef in den IP-Stack zu leiten, kann angeben werden:        table bridge global {              chain pre {                      type filter hook prerouting priority 0; policy accept;                      ether daddr de:ad:00:00:be:ef meta pkttype set host ether   daddr set meta ibrhwaddr accept              }      }\n<li class=\"l\"> Neue Infrastruktur f\u00fcr Fuzzing-Tests mit dem afl++ (American Fuzzy Lop++) Werkzeugkasten hinzugef\u00fcgt, die w\u00e4hrend des Builds \u00fcber '.\/configure --with-fuzzer' aktiviert wird.            <\/ul>\n<p>Quelle: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=64386\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.1.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libnftnl 1.3.1, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0439 API \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 nf_tables. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-150734","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.1.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-1-6\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"de_DE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.1.6 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.1.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-1-6\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-12-05T21:12:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-12-05T21:12:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Die Ver\u00f6ffentlichung des Paketfilters nftables 1.1.6 | ProHoster","description":"Die Ver\u00f6ffentlichung des Paketfilters nftables 1.1.6 wurde bekannt gegeben, der die Schnittstellen f\u00fcr die Paketfilterung von IPv4, IPv6, ARP und Netzwerkbr\u00fccken vereinheitlicht (zielt darauf ab, iptables, ip6table, arptables und ebtables zu ersetzen).","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-1-6","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.1.6 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.1.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-1-6","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-05T21:12:01+00:00","article:modified_time":"2025-12-05T21:12:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"150734","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:27:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:27:19","updated":"2026-01-23 16:27:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/150734","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=150734"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/150734\/revisions"}],"predecessor-version":[{"id":164237,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/150734\/revisions\/164237"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=150734"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=150734"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=150734"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}