{"id":37278,"date":"2019-10-31T22:16:45","date_gmt":"2019-10-31T19:16:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-paketnogo-filtra-nftables-0-9-2\/"},"modified":"2019-10-31T22:16:45","modified_gmt":"2019-10-31T19:16:45","slug":"vypusk-paketnogo-filtra-nftables-0-9-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","title":{"rendered":"Lancement du filtrage de paquets nftables 0.9.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=156621590113089&#038;w=2\">A eu lieu<\/a><\/noindex> publication du filtre de paquets <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.2<\/a><\/noindex>, qui se d\u00e9veloppe comme une alternative \u00e0 iptables, ip6table, arptables et ebtables gr\u00e2ce \u00e0 l'unification des interfaces de filtrage des paquets pour IPv4, IPv6, ARP et les ponts r\u00e9seaux. Le paquet nftables comprend des composants de filtrage de paquets fonctionnant en espace utilisateur, tandis qu'au niveau du noyau, le travail est assur\u00e9 par le sous-syst\u00e8me nf_tables, inclus dans le noyau Linux depuis la version 3.13. Les modifications n\u00e9cessaires pour le fonctionnement de la version nftables 0.9.2 sont comprises dans le noyau Linux 5.3.<\/p>\n<p>Au niveau du noyau, seule une interface g\u00e9n\u00e9rale, ind\u00e9pendante du protocole sp\u00e9cifique, est fournie, offrant des fonctions de base pour l'extraction de donn\u00e9es \u00e0 partir de paquets, l'ex\u00e9cution d'op\u00e9rations sur les donn\u00e9es et la gestion du flux. La logique de filtrage et les gestionnaires sp\u00e9cifiques aux protocoles sont compil\u00e9s en bytecode en espace utilisateur, apr\u00e8s quoi ce bytecode est charg\u00e9 dans le noyau via l'interface Netlink et ex\u00e9cut\u00e9 dans une machine virtuelle sp\u00e9ciale, similaire \u00e0 BPF (Berkeley Packet Filters). Cette approche permet de r\u00e9duire consid\u00e9rablement la taille du code de filtrage qui fonctionne au niveau du noyau et d'externaliser toutes les fonctions d'analyse des r\u00e8gles et de logique de travail avec les protocoles en espace utilisateur.<\/p>\n<p>Les principales nouveaut\u00e9s :<\/p>\n<ul>\n<li class=\"l\"> La possibilit\u00e9 de v\u00e9rifier le num\u00e9ro de port \u00e0 partir de l'en-t\u00eate de paquet de la couche de transport, ind\u00e9pendamment du type de protocole de la couche 4 :\n<p>   add rule x y ip protocol { tcp, udp } th dport 53<\/p>\n<li class=\"l\"> Prise en charge de la r\u00e9cup\u00e9ration de la dur\u00e9e de vie d'un ensemble d'\u00e9l\u00e9ments :\n<p>   add element ip x y { 1.1.1.1 timeout 30s expires 15s }<\/p>\n<li class=\"l\"> Possibilit\u00e9 de v\u00e9rifier des options individuelles (lsrr, rr, ssrr et ra) dans les paquets IPv4 :\n<p>   add rule x y ip option rr exists drop<\/p>\n<p>Pour les options de routage, il est possible de v\u00e9rifier les champs type, ptr, length et addr :<\/p>\n<p>   add rule x y ip option rr type 1 drop<\/p>\n<li class=\"l\"> Dans les expressions, il est d\u00e9sormais permis de sp\u00e9cifier des pr\u00e9fixes r\u00e9seau et des plages d'adresses :\n<p>   iifname ens3 snat to 10.0.0.0\/28<br \/>\n   iifname ens3 snat to 10.0.0.1-10.0.0.15<\/p>\n<li class=\"l\"> Prise en charge de l'utilisation de variables dans les d\u00e9finitions de cha\u00eenes :\n<p>    define default_policy = accept<br \/>\n    add chain ip foo bar { type filter hook input priority filter; policy $default_policy }<\/p>\n<li class=\"l\"> La sp\u00e9cification de la priorit\u00e9 de la cha\u00eene peut d\u00e9sormais se faire \u00e0 la fois sous forme num\u00e9rique et symbolique :\n<p>    define prio = filter<br \/>\n    define prionum = 10<br \/>\n    d\u00e9finir prioffset = \u00ab filtre \u2014 150 \u00bb<\/p>\n<p>    add table ip foo<br \/>\n    add chain ip foo bar { type filter hook input priority $prio; }<br \/>\n    add chain ip foo ber { type filter hook input priority $prionum; }<br \/>\n    add chain ip foo bor { type filter hook input priority $prioffset; }<\/p>\n<li class=\"l\"> Prise en charge du module synproxy. Par exemple, pour prot\u00e9ger le port TCP 8888 avec synproxy, vous pouvez utiliser un ensemble de r\u00e8gles :\n<p>    table ip x {<br \/>\n            cha\u00eene y {<br \/>\n                    type filter hook prerouting priority raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            cha\u00eene z {<br \/>\n                    type filter hook forward priority filter; policy accept;<br \/>\n                    tcp dport 8888 ct \u00e9tat invalide, non suivi synproxy mss 1460 \\<br \/>\n                       wscale 7 timestamp sack-perm ct state invalid drop<br \/>\n            }<br \/>\n    }<\/p>\n<li class=\"l\"> Pour d\u00e9terminer dans la table conntrack les connexions suppl\u00e9mentaires attendues associ\u00e9es \u00e0 la connexion actuelle, qui sont appliqu\u00e9es dans les protocoles et sc\u00e9narios n\u00e9cessitant l'\u00e9tablissement de plusieurs connexions, il est maintenant possible de d\u00e9finir des politiques via les ensembles de r\u00e8gles standards. Par exemple, pour d\u00e9finir les connexions attendues suite \u00e0 une connexion au port TCP 8888, pour celles visant le port 5432, vous pouvez sp\u00e9cifier les r\u00e8gles suivantes :\n<p>        table x {<br \/>\n                ct expectation myexpect {<br \/>\n                        protocol tcp<br \/>\n                        dport 5432<br \/>\n                        timeout 1h<br \/>\n                        size 12<br \/>\n                        l3proto ip<br \/>\n                }<\/p>\n<p>                chain input {<br \/>\n                        type filter hook input priority 0;<br \/>\n                        ct state new tcp dport 8888 ct expectation set myexpect<br \/>\n                        ct state established,related counter accept<br \/>\n                }<br \/>\n        }<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51312\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sortie du filtre de paquets nftables 0.9.2 | ProHoster","description":"La sortie du filtre de paquets a eu lieu","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster","og:description":"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:45+00:00","article:modified_time":"2019-10-31T19:16:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:04:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:30:00","updated":"2026-01-23 17:04:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/37278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=37278"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/37278\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=37278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=37278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=37278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}