{"id":53598,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-paketnogo-filtra-nftables-0-9-3"},"modified":"2020-02-18T14:01:31","modified_gmt":"2020-02-18T11:01:31","slug":"vypusk-paketnogo-filtra-nftables-0-9-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","title":{"rendered":"V\u00e4ljaande paketifiltrit nftables 0.9.3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=linux-netdev&#038;m=157532146517289&#038;w=2\">Avaldatud<\/a><\/noindex> paketifiltri v\u00e4ljaanne <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.3<\/a><\/noindex>, mis areneb iptables'i, ip6table'i, arptables'i ja ebtables'i asendamiseks, \u00fchtlustades pakettide filtreerimise liideseid IPv4, IPv6, ARP ja v\u00f5rgusilla jaoks. Paketis nftables on komponentide paketifilter, mis t\u00f6\u00f6tab kasutajaruumi, samas kui tuumatasandil tagab t\u00f6\u00f6 nf_tables alam s\u00fcsteem, mis on osa Linuxi tuumast alates v\u00e4ljaandest 3.13. Nftables 0.9.3 v\u00e4ljaande jaoks vajalikud muudatused on lisatud tulevase Linuxi tuuma 5.5 haru koosseisu.<\/p>\n<p>Tuumatasandil pakutakse ainult \u00fcldist liidest, mis ei s\u00f5ltu konkreetsest protokollist ja pakub p\u00f5hifunktsioone andmete ekstraktsiooniks pakettidest, andmete t\u00f6\u00f6tlemiseks ja voogude haldamiseks. Otsene filtreerimise loogika ja protokollip\u00f5hised t\u00f6\u00f6tlejad kompileeritakse kasutajaruumi 'bytecode', mis seej\u00e4rel laaditakse tuuma mitteliidese kaudu ja k\u00e4itatakse spetsiaalses virtuaalmasinas, mis meenutab BPF-i (Berkeley Packet Filters). Selline l\u00e4henemine v\u00f5imaldab oluliselt v\u00e4hendada tuumatasandil t\u00f6\u00f6tava filtreerimiskoodi suurust, viies k\u00f5ik reeglite k\u00e4sitlemise ja protokollide t\u00f6\u00f6tlemise funktsioonid kasutajaruumi.<\/p>\n<p>Peamised uuendused:<\/p>\n<ul>\n<li class=\"l\"> Pakettide ajakohastamise tugi. Saab m\u00e4\u00e4rata ajavahemikud ja kuup\u00e4evad, millal reegel kehtib, ning seadistada aktiveerimise konkreetsetel n\u00e4dalap\u00e4evadel. Samuti on lisatud uus valik \u00ab-T\u00bb, et n\u00e4idata ajastut sekundites.\n<p>     meta aeg \u00ab2019-12-24 16:00\u00bb \u2014 \u00ab2020-01-02 7:00\u00bb<br \/>\n     meta tund \u00ab17:00\u00bb \u2014 \u00ab19:00\u00bb<br \/>\n     meta p\u00e4ev \u00abReede\u00bb<\/p>\n<li class=\"l\"> SELinuxi (secmark) sildide taastamise ja salvestamise tugi.\n<p>     ct secmark set meta secmark<br \/>\n     meta secmark set ct secmark<\/p>\n<li class=\"l\"> tugi map-loenditele synproxy, mis v\u00f5imaldavad m\u00e4\u00e4rata rohkem kui \u00fcks reegel tahkete tagasij\u00f5udmiseks.\n<p>    table ip foo {<br \/>\n            synproxy https-synproxy {<br \/>\n                    mss 1460<br \/>\n                    wscale 7<br \/>\n                    timestamp sack-perm<br \/>\n            }<\/p>\n<p>            synproxy other-synproxy {<br \/>\n                    mss 1460<br \/>\n                    wscale 5<br \/>\n            }<\/p>\n<p>            chain pre {<br \/>\n                    type filter hook prerouting priority raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            chain bar {<br \/>\n                    type filter hook forward priority filter; policy accept;<br \/>\n                    ct olek invalid, untracked synproxy nimi ip saddr kaart { 192.168.1.0\/24 : \u00abhttps-synproxy\u00bb, 192.168.2.0\/24 : \u00abother-synproxy\u00bb }<br \/>\n            }<br \/>\n     }<\/p>\n<li class=\"l\"> D\u00fcnaamilise eemaldamise v\u00f5imalus set-gruppidest pakettide t\u00f6\u00f6tlemise reeglitest.\n<p>     nft lisa reegel \u2026 kustuta @set5 { ip6 saddr . ip6 daddr }<\/p>\n<li class=\"l\"> Tuge ajamerrorite tuvastamiseks VLAN-i p\u00f5hjal, mis on m\u00e4\u00e4ratud v\u00f5rgusilla liidese metaandmetes;\n<p>        meta ibrpvid 100<br \/>\n        meta ibrvproto vlan<\/p>\n<li class=\"l\"> Valik \u00ab-t\u00bb (\u00ab\u2014terse\u00bb) elementide set-i komplektide v\u00e4listamiseks reeglite kuvamisel. Kui t\u00e4idetakse \u00abnft -t list ruleset\u00bb, kuvatakse:\n<p>    table ip x {<br \/>\n        set y {<br \/>\n                type ipv4_addr<br \/>\n        }<br \/>\n    }<\/p>\n<p>Aga \u00abnft list ruleset\u00bb<\/p>\n<p>    table ip x {<br \/>\n        set y {<br \/>\n                type ipv4_addr<br \/>\n                elements = { 192.168.10.2, 192.168.20.1,<br \/>\n                             192.168.4.4, 192.168.2.34 }<br \/>\n        }<br \/>\n    }<\/p>\n<li class=\"l\"> V\u00f5imalus m\u00e4\u00e4rata rohkem kui \u00fcks seade netdev-ahelates (t\u00f6\u00f6tavad ainult koos kerneliga 5.5) standardsete filtreerimise reeglite \u00fchendamiseks.\n<p>     add table netdev x<br \/>\n     lisa ahel netdev x y { \\<br \/>\n        type filter hook ingress devices = { eth0, eth1 } priority 0;<br \/>\n     }<\/p>\n<li class=\"l\"> V\u00f5imalus lisada andmet\u00fc\u00fcpide kirjeldusi.\n<p>    # nft describe ipv4_addr<br \/>\n    datatype ipv4_addr (IPv4 address) (basetype integer), 32 bitti<\/p>\n<li class=\"l\"> V\u00f5imalus koostada CLI-liidese linenoise raamatukoguga libreadline'i asemel.\n<p>     .\/configure \u2014with-cli=linenoise<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51980\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53598","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:31+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pakettfiltri nftables 0.9.3 v\u00e4ljaanne | ProHoster","description":"V\u00e4lja anti pakettfiltri v\u00e4ljaanne","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53598","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:02:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:49","updated":"2026-01-24 08:02:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=53598"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/53598\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=53598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=53598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=53598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}