{"id":37278,"date":"2019-10-31T22:16:45","date_gmt":"2019-10-31T19:16:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-paketnogo-filtra-nftables-0-9-2\/"},"modified":"2019-10-31T22:16:45","modified_gmt":"2019-10-31T19:16:45","slug":"vypusk-paketnogo-filtra-nftables-0-9-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","title":{"rendered":"Nftables paketi v\u00e4ljaanne 0.9.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=156621590113089&#038;w=2\">Toimus<\/a><\/noindex> paketifiltri v\u00e4ljaanne <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.2<\/a><\/noindex>, mis areneb iptablesi, ip6table'i, arptables'i ja ebtables'i asendamiseks, unifitseerides pakettide filtreerimise liideseid IPv4, IPv6, ARP ja v\u00f5rgu sillutamiseks. Nftablesi paketis on kasutusruumi pakettide filtreerimise komponente, samas kui tuuma tasemel tagab toimimise nf_tables'i alams\u00fcsteem, mis on osa Linuxi tuumast alates versioonist 3.13. Nftables 0.9.2 v\u00e4ljaande t\u00f6\u00f6ks vajalikud muudatused on lisatud Linuxi tuuma versioonis 5.3.<\/p>\n<p>Tuumatasandil pakutakse ainult \u00fcldist liidest, mis ei s\u00f5ltu konkreetsest protokollist ja pakub p\u00f5hifunktsioone andmete ekstraktsiooniks pakettidest, andmete t\u00f6\u00f6tlemiseks ja voogude haldamiseks. Otsene filtreerimise loogika ja protokollip\u00f5hised t\u00f6\u00f6tlejad kompileeritakse kasutajaruumi 'bytecode', mis seej\u00e4rel laaditakse tuuma mitteliidese kaudu ja k\u00e4itatakse spetsiaalses virtuaalmasinas, mis meenutab BPF-i (Berkeley Packet Filters). Selline l\u00e4henemine v\u00f5imaldab oluliselt v\u00e4hendada tuumatasandil t\u00f6\u00f6tava filtreerimiskoodi suurust, viies k\u00f5ik reeglite k\u00e4sitlemise ja protokollide t\u00f6\u00f6tlemise funktsioonid kasutajaruumi.<\/p>\n<p>Peamised uuendused:<\/p>\n<ul>\n<li class=\"l\"> V\u00f5imalus kontrollida sadama numbrit transportkihi paketipea kaudu s\u00f5ltumata 4. tasandi protokollist:\n<p>   add rule x y ip protocol { tcp, udp } th dport 53<\/p>\n<li class=\"l\"> Eluea taastamise toetamine elementide kogumites:\n<p>   add element ip x y { 1.1.1.1 timeout 30s expires 15s }<\/p>\n<li class=\"l\"> V\u00f5imalus kontrollida \u00fcksikuid valikuid (lsrr, rr, ssrr ja ra) IPv4 paketist:\n<p>   add rule x y ip option rr exists drop<\/p>\n<p>Marsruutimisvalikute jaoks on v\u00f5imalik kontrollida v\u00e4lja type, ptr, length ja addr:<\/p>\n<p>   add rule x y ip option rr type 1 drop<\/p>\n<li class=\"l\"> V\u00e4ljendites on n\u00fc\u00fcd lubatud m\u00e4\u00e4rata v\u00f5rgu eeliseid ja aadresside vahemikke:\n<p>   iifname ens3 snat to 10.0.0.0\/28<br \/>\n   iifname ens3 snat to 10.0.0.1-10.0.0.15<\/p>\n<li class=\"l\"> Toetab muutujate kasutamist ketaste m\u00e4\u00e4ratlemisel:\n<p>    define default_policy = accept<br \/>\n    add chain ip foo bar { type filter hook input priority filter; policy $default_policy }<\/p>\n<li class=\"l\"> Kettide prioriteedi m\u00e4\u00e4ramine on n\u00fc\u00fcd v\u00f5imalik numbrilises ja s\u00fcmboolses vormis:\n<p>    define prio = filter<br \/>\n    define prionum = 10<br \/>\n    define prioffset = \u00abfilter \u2014 150\u00bb<\/p>\n<p>    add table ip foo<br \/>\n    add chain ip foo bar { type filter hook input priority $prio; }<br \/>\n    add chain ip foo ber { type filter hook input priority $prionum; }<br \/>\n    add chain ip foo bor { type filter hook input priority $prioffset; }<\/p>\n<li class=\"l\"> Toetab synproxy mooduli rakendamist. N\u00e4iteks TCP pordi 8888 kaitsmiseks saab kasutada j\u00e4rgmisi reegleid:\n<p>    table ip x {<br \/>\n            chain y {<br \/>\n                    type filter hook prerouting priority raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            chain z {<br \/>\n                    type filter hook forward priority filter; policy accept;<br \/>\n                    tcp dport 8888 ct state invalid, untracked synproxy mss 1460 \\<br \/>\n                       wscale 7 timestamp sack-perm  ct state invalid drop<br \/>\n            }<br \/>\n    }<\/p>\n<li class=\"l\"> N\u00fc\u00fcd saab m\u00e4\u00e4rata \u00fchendustootmise poliitikaid tavaliste reeglite kogumite kaudu, et m\u00e4\u00e4rata tabelis conntrack oodatud lisast \u00fchendusi, mis vajavad mitme \u00fchenduse loomist protokollide ja stsenaariumite korral. N\u00e4iteks, et m\u00e4\u00e4rata port 8888 TCP-\u00fchenduse oodatud j\u00e4rgmised \u00fchendused porti 5432, saab kirjutada j\u00e4rgmised reeglid:\n<p>        table x {<br \/>\n                ct expectation myexpect {<br \/>\n                        protocol tcp<br \/>\n                        dport 5432<br \/>\n                        timeout 1h<br \/>\n                        size 12<br \/>\n                        l3proto ip<br \/>\n                }<\/p>\n<p>                chain input {<br \/>\n                        type filter hook input priority 0;<br \/>\n                        ct state new tcp dport 8888 ct expectation set myexpect<br \/>\n                        ct state established,related counter accept<br \/>\n                }<br \/>\n        }<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51312\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pakettfilteri nftables 0.9.2 v\u00e4ljaanne | ProHoster","description":"Ilmus pakettfilteri vabastamine","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster","og:description":"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:45+00:00","article:modified_time":"2019-10-31T19:16:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:04:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:30:00","updated":"2026-01-23 17:04:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37278"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37278\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}