{"id":76505,"date":"2020-04-02T19:42:00","date_gmt":"2020-04-02T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-0-9-4"},"modified":"2020-04-02T19:42:00","modified_gmt":"2020-04-02T17:42:00","slug":"vypusk-paketnogo-filtra-nftables-0-9-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","title":{"rendered":"Nftablesi 0.9.4 paketifiltri v\u00e4ljaanne","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=158575148505527&#038;w=2\">Avaldatud<\/a><\/noindex> paketifiltri v\u00e4ljaanne <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.4<\/a><\/noindex>, areneb olema iptables, ip6table, arptables ja ebtables asendaja, pakettide filtreerimise liideste \u00fchtsustamise abil IPv4, IPv6, ARP ja v\u00f5rgu sillutamiseks. Paketi nftables koosseisus on kasutusruumis t\u00f6\u00f6tavad pakettide filtreerimise komponendid, samas kui s\u00fcdamikus tagab t\u00f6\u00f6 nf_tables alams\u00fcsteem, mis on Linuxi tuumas alates versioonist 3.13. N\u00f6\u00f6damisega nftables 0.9.4 t\u00f6\u00f6tamiseks vajalikud muudatused on tulevase tuuma haru koosseisus. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52632\">Linux 5.6<\/a><\/noindex>.<\/p>\n<p>S\u00fcdamiku tasemel pakutakse vaid \u00fcldist liidest, mis ei s\u00f5ltu konkreetsest protokollist ja pakub p\u00f5hifunktsioone andmete extracatsiooniks pakettidest, andmete opereerimiseks ja voolu juhtimiseks. Otsesed filtreerimise reeglid ja protokollispetsiifilised t\u00f6\u00f6tlejajad kompileeritakse kasutusruumis baitkoodiks, seej\u00e4rel laaditakse see baitkood Netlinki liidese abil tuuma ja t\u00e4idetakse tuumas spetsiaalses virtuaalmasinas, mis sarnaneb BPF-iga (Berkeley Packet Filters). Selline l\u00e4henemine v\u00f5imaldab oluliselt v\u00e4hendada s\u00fcdamikus t\u00f6\u00f6tava filtreerimise koodi suurust ja viia k\u00f5ik reeglite anal\u00fc\u00fcsi ja protokollide t\u00f6\u00f6tlemise loogika kasutusruumi.<\/p>\n<p>Peamised uuendused:\n<\/p>\n<ul>\n<li class=\"l\"> Toetatakse vahemike kasutamist liitmistes (concatenation, teatud aadresside ja portide \u00fchendused, mis lihtsustavad vastavust). N\u00e4iteks, 'whitelist' hulga puhul, mille elemendid on liitmine, n\u00e4itab 'interval' lipu m\u00e4\u00e4ramine, et hulk v\u00f5ib sisaldada vahemikke liitmises (varem sai 'ipv4_addr . ipv4_addr . inet_service' liitmisele t\u00e4psed vasteid nagu '192.168.10.35 . 192.68.11.123 . 80', n\u00fc\u00fcd saab m\u00e4\u00e4rata aadressigruppide '192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80'):\n<p>    table ip foo {<br \/>\n           seata whitelist {<br \/>\n                   t\u00fc\u00fcp ipv4_addr . ipv4_addr . inet_service<br \/>\n                   lipud intervall<br \/>\n                   elemendid = { 192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80 }<br \/>\n           }<\/p>\n<p>           chain bar {<br \/>\n                   t\u00fc\u00fcp filter hook prerouting prioriteet filter; poliitika drop;<br \/>\n                   ip saddr . ip daddr . tcp dport @whitelist accept<br \/>\n           }<br \/>\n    }<\/p>\n<li class=\"l\"> Hulkades ja kaardiloendites on v\u00f5imalik kasutada direktiivi 'typeof', mis m\u00e4\u00e4ratleb elemendi formaadi vastavuses.<br \/>\n N\u00e4iteks:<\/p>\n<p>     table ip foo {<br \/>\n            seata whitelist {<br \/>\n                    typeof ip saddr<br \/>\n                    elemendid = { 192.168.10.35, 192.168.10.101, 192.168.10.135 }<br \/>\n            }<\/p>\n<p>            chain bar {<br \/>\n                    t\u00fc\u00fcp filter hook prerouting prioriteet filter; poliitika drop;<br \/>\n                    ip daddr @whitelist accept<br \/>\n            }<br \/>\n     }<\/p>\n<p>     table ip foo {<br \/>\n            map addr2mark {<br \/>\n                typeof ip saddr : meta mark<br \/>\n                elemendid = { 192.168.10.35 : 0x00000001, 192.168.10.135 : 0x00000002 }<br \/>\n            }<br \/>\n     }<\/p>\n<li class=\"l\"> Lisatud v\u00f5imalus kasutada NAT-side\u00fchendustes, mis v\u00f5imaldab m\u00e4\u00e4rata aadressi ja porti NAT-muutuste m\u00e4\u00e4ratlemisel map-loendite v\u00f5i nimetatud kogumite alusel:\n<p>      nft add rule ip nat pre dnat ip addr . port to ip saddr map { 1.1.1.1 : 2.2.2.2 . 30 }<\/p>\n<p>      nft add map ip nat destinations { type ipv4_addr . inet_service : ipv4_addr . inet_service \\; }<br \/>\n      nft add rule ip nat pre dnat ip addr . port to ip saddr . tcp dport map @destinations<\/p>\n<li class=\"l\"> Toetatakse riistvaralist kiirendust, mis viib m\u00f5ned filtreerimise toimingud v\u00f5rkaartide kanda. Kiirus aktiveeritakse utiliidiga ethtool ('ethtool -K eth0 hw-tc-offload on'), seej\u00e4rel aktiveeritakse see nftables p\u00f5hikaeluses lipu 'offload' abil. Linuxi 5.6 tuuma kasutamisel toetatakse riistvaralist kiirendust pealmise v\u00e4lja vastavuse ja sissetuleva liidese kontrollimiseks koos vastuv\u00f5tu, eemaldamise, dubleerimise (dup) ja \u00fcmber suunamise (fwd) paketin\u00e4idudega. Allolevas n\u00e4ites eemaldatakse 192.168.30.20 aadressilt tulevad paketid v\u00f5rgukaardi tasemel, ilma et pakette edastataks tuumale:\n<p>     # cat file.nft<br \/>\n     table netdev x {<br \/>\n            chain y {<br \/>\n                type filter hook ingress device eth0 priority 10; flags offload;<br \/>\n                ip saddr 192.168.30.20 drop<br \/>\n            }<br \/>\n     }<br \/>\n     # nft -f file.nft<\/p>\n<li class=\"l\"> Parandatud veateadet reeglite viga asukohast.\n<p>     # nft delete rule ip y z handle 7<br \/>\n     Error: Reegli t\u00f6\u00f6tlemine eba\u00f5nnestus: Sellist faili v\u00f5i katalooge ei leitud<br \/>\n     delete rule ip y z handle 7<br \/>\n                    ^<\/p>\n<p>     # nft delete rule ip x x handle 7<br \/>\n     Error: Reegli t\u00f6\u00f6tlemine eba\u00f5nnestus: Sellist faili v\u00f5i katalooge ei leitud<br \/>\n     delete rule ip x x handle 7<br \/>\n                               ^<\/p>\n<p>     # nft delete table twst<br \/>\n     Error: Ei ole sellist faili ega katalooge; kas sa m\u00f5tlesid tabelit 'test' IP perekonnas?<br \/>\n     delete table twst<br \/>\n                  ^^^^<\/p>\n<p>Esimeses n\u00e4ites on n\u00e4idatud, et tabel 'y' puudub s\u00fcsteemist, teises, et t\u00f6\u00f6tlejat '7' ei leitud ning kolmandas, et kuvatakse vihje vale kirjutamise osas tabeli nime sisestamisel.<\/p>\n<li class=\"l\"> Lisatud on toe kontrollimiseks slave-liidese l\u00e4bi 'meta sdif' v\u00f5i 'meta sdifname' m\u00e4\u00e4ratud:\n<p>        ... meta sdifname vrf1 ...<\/p>\n<li class=\"l\"> Lisatud paremale v\u00f5i vasakule nihkumise toiming. N\u00e4iteks, et nihutada olemasolevat pakettide sildi vasakule 1 bitti ja seadistada madalam bitt 1:\n<p>        ... meta mark set meta mark lshift 1 or 0x1 ...<\/p>\n<li class=\"l\"> Teostatud on v\u00f5imalus '-V', et n\u00e4idata \u00fcksikasjalikku teavet versiooni kohta.\n<p>     # nft -V<br \/>\n       nftables v0.9.4 (Jive at Five)<br \/>\n          cli:          readline<br \/>\n          json:         yes<br \/>\n          minigmp:      no<br \/>\n          libxtables:   yes<\/p>\n<li class=\"l\"> K\u00e4skude valikute kohustuslik m\u00e4\u00e4ramine peab olema enne k\u00e4ske. N\u00e4iteks tuleb kasutada 'nft -a list ruleset', samas kui 'nft list ruleset -a' k\u00e4ivitamine p\u00f5hjustab veateate.\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Allikas: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52656\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-76505","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-02T17:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-02T17:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 nftables 0.9.4 v\u00e4ljaanne | ProHoster","description":"V\u00e4lja anti pakettfiltri v\u00e4ljaanne","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-02T17:42:00+00:00","article:modified_time":"2020-04-02T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76505","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:35:41","updated":"2022-10-07 02:56:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/76505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=76505"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/76505\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=76505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=76505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=76505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}