{"id":106246,"date":"2022-12-23T15:36:42","date_gmt":"2022-12-23T13:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-6"},"modified":"2022-12-23T15:36:42","modified_gmt":"2022-12-23T13:36:42","slug":"vypusk-paketnogo-filtra-nftables-1-0-6","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","title":{"rendered":"Release of the nftables 1.0.6 packet filter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A release of the nftables packet filter 1.0.6 has been published, unifying the packet filtering interfaces for IPv4, IPv6, ARP, and network bridges (aimed at replacing iptables, ip6tables, arptables, and ebtables). The nftables package includes user-space components of the packet filter, while the nf_tables subsystem, which is part of the Linux kernel since version 3.13, handles operations at the kernel level. A generic interface is provided at the kernel level, independent of specific protocols, offering basic functions for data extraction from packets, data manipulation, and flow management. <\/p>\n

The filtering rules themselves and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special environment resembling BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and offloads all functions related to rule parsing and protocol logic into user space. virtual machine<\/a>Full support for lightweight tunnel templates, such as vxlan, geneve, and erspan, has been provided: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : \"t1\", 10.141.10.13 : \"t2\" } fwd to erspan1 } } Before loading the rules, a network interface erspan1 must be created: ip link add dev erspan1 type erspan external <\/p>\n

Key Changes: <\/p>\n