{"id":106246,"date":"2022-12-23T15:36:42","date_gmt":"2022-12-23T13:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-6"},"modified":"2022-12-23T15:36:42","modified_gmt":"2022-12-23T13:36:42","slug":"vypusk-paketnogo-filtra-nftables-1-0-6","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","title":{"rendered":"Pakettfilter nftables 1.0.6 v\u00e4ljaanne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Avalikustatud on nftables 1.0.6 pakettfiltri versioon, mis \u00fchtlustab pakettfiltrite liidesed IPv4, IPv6, ARP ja v\u00f5rgusildade jaoks (see on suunatud iptables, ip6tables, arptables ja ebtables asendamiseks). Ntfables'i pakett sisaldab kasutajaruumi t\u00f6\u00f6tavaid pakettfiltri komponente, samas kui tuumatasemel toetab t\u00f6\u00f6d nf_tables alams\u00fcsteem, mis on osa Linuxi tuumast alates versioonist 3.13. Tuumatasemel pakutakse vaid \u00fcldist liidest, mis ei s\u00f5ltu konkreetsetest protokollerist ning mis tagab andmete v\u00e4ljatoomise, andmetega t\u00f6\u00f6tamise ja liikluse juhtimise p\u00f5hifunktsioonid.    <\/p>\n<p>Filtreerimisreeglid ja protokollispetsiifilised t\u00f6\u00f6tlejad kompileeritakse kasutusruumis byte-koodiks, seej\u00e4rel laaditakse see byte-kood tuuma Netlinki liidese abil ja k\u00e4ivitatakse tuumas eraldi <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/vps\/abuzoustojchivye-vps\/\"   title=\"virtuaalmasinas\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4332\">virtuaalmasinas<\/a>, mis tahes BPF (Berkeley Packet Filters). Sarnane l\u00e4henemine v\u00f5imaldab oluliselt v\u00e4hendada filterkoodi suurust, mis t\u00f6\u00f6tab tuuma tasemel, ning viia k\u00f5ik reeglite parsing'u funktsioonid ja protokollide t\u00f6\u00f6tlemise loogika kasutajaruumi.    <\/p>\n<p>Peamised muudatused:  <\/p>\n<ul>\n<li class=\"l\"> Reeglite optimeerija, mis kutsub esile valiku &#171;-o\/&#8212;optimize&#187;, on seadistanud reeglite automaatse pakkimise, nende \u00fchendamise ja muundamise map- ja set-loenditeks. N\u00e4iteks reeglid         # cat ruleset.nft       table ip x {              chain y {                     type filter hook input priority filter; policy drop;                     meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept                     meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.4 accept                     meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.3.0\/24 accept                     meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.4.0-2.2.4.10   accept                     meta iifname eth2 ip saddr 1.1.1.3 ip daddr 2.2.2.5 accept              }       }    p\u00e4rast k\u00e4ivitamist &#171;nft -o -c -f ruleset.nft&#187; muutuvad j\u00e4rgmisteks:         ruleset.nft:4:17-74:                 meta iifname eth1 ip saddr 1.1.1.1 ip   daddr 2.2.2.3 accept       ruleset.nft:5:17-74:                 meta iifname eth1 ip saddr 1.1.1.2 ip   daddr 2.2.2.4 accept       ruleset.nft:6:17-77:                 meta iifname eth1 ip saddr 1.1.1.2 ip   daddr 2.2.3.0\/24 accept       ruleset.nft:7:17-83:                 meta iifname eth1 ip saddr 1.1.1.2 ip   daddr 2.2.4.0-2.2.4.10 accept       ruleset.nft:8:17-74:                 meta iifname eth2 ip saddr 1.1.1.3 ip   daddr 2.2.2.5 accept       muutuvad:               iifname . ip saddr . ip daddr { eth1 . 1.1.1.1 . 2.2.2.3, eth1 .   1.1.1.2 . 2.2.2.4, eth1 . 1.1.1.2 . 2.2.3.0\/24, eth1 . 1.1.1.2 .   2.2.4.0-2.2.4.10, eth2 . 1.1.1.3 . 2.2.2.5 } accept\n<li class=\"l\"> Optimeerija suudab ka muundada reeglid kompaktsemaks vormiks, kus juba kasutatakse lihtsaid set-loendeid, n\u00e4iteks reeglid:         # cat ruleset.nft       table ip filter {              chain input {                     type filter hook input priority filter; policy drop;                     iifname &#171;lo&#187; accept                     ct state established,related accept comment &#171;Liiklust, millesse me sekkume, usaldame&#187;                     iifname &#171;enp0s31f6&#187; ip saddr { 209.115.181.102,   216.197.228.230 } ip daddr 10.0.0.149 udp sport 123 udp dport 32768-65535 accept                     iifname &#171;enp0s31f6&#187; ip saddr { 64.59.144.17, 64.59.150.133 }   ip daddr 10.0.0.149 udp sport 53 udp dport 32768-65535 accept             }       }    p\u00e4rast k\u00e4ivitamist &#171;nft -o -c -f ruleset.nft&#187; pakitakse need j\u00e4rgmiselt:         ruleset.nft:6:22-149:                      iifname &#171;enp0s31f6&#187; ip saddr {   209.115.181.102, 216.197.228.230 } ip daddr 10.0.0.149 udp sport 123 udp dport   32768-65535 accept       ruleset.nft:7:22-143:                      iifname &#171;enp0s31f6&#187; ip saddr {   64.59.144.17, 64.59.150.133 } ip daddr 10.0.0.149 udp sport 53 udp dport   32768-65535 accept       muutuvad:                  iifname . ip saddr . ip daddr . udp sport . udp dport {   enp0s31f6 . 209.115.181.102 . 10.0.0.149 . 123 . 32768-65535, enp0s31f6 .   216.197.228.230 . 10.0.0.149 . 123 . 32768-65535, enp0s31f6 . 64.59.144.17 .   10.0.0.149 . 53 . 32768-65535, enp0s31f6 . 64.59.150.133 . 10.0.0.149 . 53 .   32768-65535 } accept\n<li class=\"l\"> Lahendatud probleem, mis puudutab baitkoodi genereerimist intervallide \u00fchendamiseks, kus kasutatakse erineva baitide j\u00e4rjekorra t\u00fc\u00fcpide vahe, n\u00e4iteks IPv4 (v\u00f5rgupoolne baitide j\u00e4rjekord) ja meta mark (s\u00fcsteemne baitide j\u00e4rjekord).        table ip x {             map w {                   typeof ip saddr . meta mark : verdict                   flags interval                   counter                   elements = {                           127.0.0.1-127.0.0.4 . 0x123434-0xb00122 : accept,                           192.168.0.10-192.168.1.20 . 0x0000aa00-0x0000aaff : accept,                   }            }            chain k {                   type filter hook input priority filter; policy drop;                   ip saddr . meta mark vmap @w            }      }\n<li class=\"l\"> Kohandatud haruldaste protokollide vastavus raw-v\u00e4ljendite kasutamisel, n\u00e4iteks:         meta l4proto 91 @th,400,16 0x0 accept\n<li class=\"l\"> Lahendatud probleemid reeglite sisestamisega intervallide osas:         insert rule x y tcp sport { 3478-3497, 16384-16387 } counter accept\n<li class=\"l\"> Parendatud API JSON, mis n\u00fc\u00fcd toetab v\u00e4ljendeid set- ja map-loendites.\n<li class=\"l\"> Python-teegi nftables laiendustes on lubatud laadida reeglite kogumeid t\u00f6\u00f6tlemiseks kontrollre\u017eiimis (&#171;-c&#187;) ning on lisatud tugi v\u00e4listatud muutujate m\u00e4\u00e4ratlemiseks.\n<li class=\"l\"> Set-loendite elementides on lubatud kommentaaride lisamine.\n<li class=\"l\"> Byte ratelimit'is on lubatud nullv\u00e4\u00e4rtuse m\u00e4\u00e4ramine.    <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58378\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106246","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-12-23T13:36:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-23T13:36:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pakettfiltri nftables 1.0.6 v\u00e4ljaanne | ProHoster","description":"Avaldatud on nftables 1.0.6 pakettfilteri v\u00e4ljaanne, mis \u00fchtlustab pakettide filterimise liideseid IPv4, IPv6, ARP ja v\u00f5rgu sillade jaoks (suunatud iptables, ip6table, arptables ja ebtables asendamisele).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-23T13:36:42+00:00","article:modified_time":"2022-12-23T13:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=106246"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106246\/revisions"}],"predecessor-version":[{"id":164207,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106246\/revisions\/164207"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=106246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=106246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=106246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}