{"id":35676,"date":"2019-10-31T22:05:42","date_gmt":"2019-10-31T19:05:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-paketnogo-filtra-nftables-0-9-1\/"},"modified":"2019-10-31T22:05:42","modified_gmt":"2019-10-31T19:05:42","slug":"vypusk-paketnogo-filtra-nftables-0-9-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-1","title":{"rendered":"Release of the nftables batch filter 0.9.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>After a year of development <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=156139496810281\">introduced<\/a><\/noindex> release of the packet filter <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.1<\/a><\/noindex>, evolving as a replacement for iptables, ip6tables, arptables, and ebtables through the unification of packet filtering interfaces for IPv4, IPv6, ARP, and network bridges. The nftables package includes user space packet filtering components, while the nf_tables subsystem operates at the kernel level and has been part of the Linux kernel since version 3.13. <\/p>\n<p>At the kernel level, only a common interface is provided, independent of specific protocols, offering basic functionalities for extracting data from packets, performing operations on that data, and managing traffic.<br \/>\nThe actual filtering logic and protocol-specific handlers are compiled into bytecode in user space, which is then loaded into the kernel via the Netlink interface and executed in a special virtual machine similar to BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level, moving all rule parsing functions and protocol handling logic to user space.<\/p>\n<p>Key innovations:<\/p>\n<ul>\n<li class=\"l\"> Support for IPsec allows for matching tunnel addresses related to the packet, IPsec request ID, and SPI (Security Parameter Index) tag. For example,\n<p>      ... ipsec in ip saddr 192.168.1.0\/24<br \/>\n      ... ipsec in spi 1-65536<\/p>\n<p>It is also possible to check the route passing through the IPsec tunnel. For instance, to block traffic not passing through IPsec: <\/p>\n<p>      ... filter output rt ipsec missing drop<\/p>\n<li class=\"l\"> Support for the IGMP (Internet Group Management Protocol). For example, to drop incoming IGMP membership queries, you can use the rule\n<p>      nft add rule netdev foo bar igmp type membership-query counter drop<\/p>\n<li class=\"l\"> The ability to use variables to define jump chains (jump \/ goto). For example:\n<p>      define dest = ber<br \/>\n      add rule ip foo bar jump $dest<\/p>\n<li class=\"l\"> Support for masks to identify operating systems (OS Fingerprint) based on TTL values in the header. For instance, to tag packets based on the sender's OS, you can use the command:\n<p>    ... meta mark set osf ttl skip name map { \u00abLinux\u00bb : 0x1,<br \/>\n                                              \u00abWindows\u00bb : 0x2,<br \/>\n                                              \u00abMacOS\u00bb : 0x3,<br \/>\n                                              \u00abunknown\u00bb : 0x0 }<br \/>\n    ... osf ttl skip version \u00abLinux:4.20\u00bb<\/p>\n<li class=\"l\"> The ability to match the ARP address of the sender with the IPv4 address of the target system. For example, to increase the ARP packet counter sent from address 192.168.2.1, you can use the rule:\n<p>        table arp x {<br \/>\n                chain y {<br \/>\n                        type filter hook input priority filter; policy accept;<br \/>\n                        arp saddr ip 192.168.2.1 counter packets 1 bytes 46<br \/>\n                }<br \/>\n        }<\/p>\n<li class=\"l\"> Support for transparent proxy request forwarding (tproxy). For example, to redirect requests to port 80 to proxy port 8080:\n<p>        table ip x {<br \/>\n                chain y {<br \/>\n                        type filter hook prerouting priority -150; policy accept;<br \/>\n                        tcp dport 80 tproxy to :8080<br \/>\n                }<br \/>\n        }<\/p>\n<li class=\"l\"> Support for marking sockets with the ability to later retrieve the set mark via setsockopt() in SO_MARK mode. For example:\n<p>        table inet x {<br \/>\n                chain y {<br \/>\n                        type filter hook prerouting priority -150; policy accept;<br \/>\n                        tcp dport 8080 mark set socket mark<br \/>\n                }<br \/>\n        }<\/p>\n<li class=\"l\"> Support for specifying textual names for chain priorities. For example:\n<p>        nft add chain ip x raw { type filter hook prerouting priority raw; }<br \/>\n        nft add chain ip x filter { type filter hook prerouting priority filter; }<br \/>\n        nft add chain ip x filter_later { type filter hook prerouting priority filter + 10; }<\/p>\n<li class=\"l\"> Support for SELinux labels (Secmark). For example, to define the label \u00absshtag\u00bb in the context of SELinux, you can run:\n<p>         nft add secmark inet filter sshtag \u00absystem_u:object_r:ssh_server_packet_t:s0\u00bb<\/p>\n<p>And then use this label in rules:<\/p>\n<p>        nft add rule inet filter input tcp dport 22 meta secmark set \u00absshtag\u00bb<\/p>\n<p>        nft add map inet filter secmapping { type inet_service : secmark; }<br \/>\n        nft add element inet filter secmapping { 22 : \u00absshtag\u00bb }<br \/>\n        nft add rule inet filter input meta secmark set tcp dport map @secmapping<\/p>\n<li class=\"l\"> The ability to specify the ports associated with protocols in a textual form, as defined in the file \/etc\/services. For example:\n<p>        nft add rule x y tcp dport \u00abssh\u00bb<br \/>\n        nft list ruleset -l<br \/>\n        table x {<br \/>\n                chain y {<br \/>\n                        \u2026<br \/>\n                        tcp dport \u00abssh\u00bb<br \/>\n                }<br \/>\n        }<\/p>\n<li class=\"l\"> The ability to check the type of network interface. For example:\n<p>        add rule inet raw prerouting meta iifkind \u00abvrf\u00bb accept<\/p>\n<li class=\"l\"> Improved support for dynamic updates of sets through explicit specification of the \u00abdynamic\u00bb flag. For example, to update the set \u00abs\u00bb by adding the source address and resetting the entry if no packets have been seen for 30 seconds:\n<p>        add table x<br \/>\n        add set x s { type ipv4_addr; size 128; timeout 30s; flags dynamic; }<br \/>\n        add chain x y { type filter hook input priority 0; }<br \/>\n        add rule x y update @s { ip saddr }<\/p>\n<li class=\"l\"> The ability to set a separate condition for timeout occurrence. For example, to override the default timeout for packets arriving on port 8888 you can specify:\n<p>        table ip filter {<br \/>\n                ct timeout agressive-tcp {<br \/>\n                        protocol tcp;<br \/>\n                        l3proto ip;<br \/>\n                        policy = {established: 100, close_wait: 4, close: 4}<br \/>\n                }<br \/>\n                chain output {<br \/>\n                        \u2026<br \/>\n                        tcp dport 8888 ct timeout set \u00abagressive-tcp\u00bb<br \/>\n                }<br \/>\n        }<\/p>\n<li class=\"l\"> Support for NAT for the inet family:\n<p>        table inet nat {<br \/>\n                \u2026<br \/>\n                ip6 daddr dead::2::1 dnat to dead:2::99<br \/>\n        }<\/p>\n<li class=\"l\"> Enhanced error reporting tools due to typos:\n<p>        nft add chain filtre test<\/p>\n<p>        Error: No such file or directory; did you mean table \u00abfilter\u00bb in family ip?<br \/>\n        add chain filtre test<br \/>\n                  ^^^^^^<\/p>\n<li class=\"l\"> The ability to specify interface names in sets (sets):\n<p>        set sc {<br \/>\n               type inet_service . ifname<br \/>\n               elements = { \u00abssh\u00bb . \u00abeth0\u00bb }<br \/>\n        }<\/p>\n<li class=\"l\"> Updated syntax for flowtable rules:\n<p>        nft add table x<br \/>\n        nft add flowtable x ft { hook ingress priority 0; devices = { eth0, wlan0 }; }<br \/>\n        \u2026<br \/>\n        nft add rule x forward ip protocol { tcp, udp } flow add @ft<\/p>\n<li class=\"l\"> Improved JSON support.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50952\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.1, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35676","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:05:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:05:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Release of the nftables packet filter 0.9.1 | ProHoster","description":"After a year of development, the release of the packet filter is presented","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.1 | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0433\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:42+00:00","article:modified_time":"2019-10-31T19:05:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35676","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:28","updated":"2026-01-22 00:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/35676","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=35676"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/35676\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=35676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=35676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=35676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}