{"id":107267,"date":"2023-03-14T12:48:14","date_gmt":"2023-03-14T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=107267"},"modified":"2023-03-15T19:12:55","modified_gmt":"2023-03-15T17:12:55","slug":"vypusk-paketnogo-filtra-nftables-1-0-7","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","title":{"rendered":"Uscita del filtro pacchetti nftables 1.0.7","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00c8 stata pubblicata l'uscita del filtro pacchetti nftables 1.0.7, che unifica le interfacce di filtraggio dei pacchetti per IPv4, IPv6, ARP e bridge di rete (mirando a sostituire iptables, ip6tables, arptables e ebtables). Il pacchetto nftables include componenti del filtro pacchetti che operano nello spazio utente, mentre a livello del kernel l'operativit\u00e0 \u00e8 garantita dal sottosistema nf_tables, che fa parte del kernel Linux a partire dalla versione 3.13. A livello del kernel viene fornita solo un'interfaccia generale, indipendente dal protocollo specifico e che fornisce funzioni di base per l'estrazione dei dati dai pacchetti, l'esecuzione delle operazioni sui dati e la gestione del flusso.    <\/p>\n<p>Le regole di filtraggio e i gestori specifici per i protocolli vengono compilati in bytecode nello spazio utente, dopodich\u00e9 questo bytecode viene caricato nel kernel tramite l'interfaccia Netlink e viene eseguito nel kernel in una sezione <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/vps\/abuzoustojchivye-vps\/\"   title=\"macchina virtuale\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4335\">macchina virtuale<\/a>, simile a BPF (Berkeley Packet Filters). Questo approccio consente di ridurre significativamente la dimensione del codice di filtraggio che opera a livello di kernel e di spostare tutte le funzioni di parsing delle regole e di logica di operazione con i protocolli nello spazio utente.    <\/p>\n<p>Variazioni principali:  <\/p>\n<ul>\n<li class=\"l\"> Per i sistemi con kernel Linux 6.2+ \u00e8 stata aggiunta la supporto per il matching dei protocolli vxlan, geneve, gre e gretap, permettendo di utilizzare espressioni semplici per controllare le intestazioni nei pacchetti incapsulati. Ad esempio, per controllare <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/lir\/ipv4\/\"   title=\"Indirizzi IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"711\">Indirizzi IP<\/a> Nell'intestazione del pacchetto incapsulato da VxLAN, ora \u00e8 possibile utilizzare le regole (senza la necessit\u00e0 di una pre-deincapsulazione dell'intestazione VxLAN e vincolare il filtro all'interfaccia vxlan0):          \u2026 udp dport 4789 vxlan ip protocol udp        \u2026 udp dport 4789 vxlan ip saddr 1.2.3.0\/24        \u2026 udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 }\n<li class=\"l\"> \u00c8 stata implementata la supporto per la fusione automatica dei resti dopo la rimozione parziale di un elemento dell'insieme, permettendo di rimuovere un elemento o parte di un intervallo da un intervallo esistente (in precedenza, un intervallo poteva essere rimosso solo per intero). Ad esempio, dopo la rimozione dell'elemento 25 dall'insieme con intervalli 24-30 e 40-50, nella lista rimarranno 24, 26-30 e 40-50. Le correzioni necessarie per la fusione automatica saranno proposte nelle versioni correttive dei rami stabili del kernel 5.10+.              # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24-30, 40-50 }            }        }          # nft delete element ip x y { 25 }          # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24, 26-30, 40-50 }            }        }\n<li class=\"l\"> \u00c8 consentito l'uso di contatti e intervalli nella mappatura della traduzione degli indirizzi (NAT).      table ip nat {        chain prerouting {            type nat hook prerouting priority dstnat; policy accept;            dnat to ip daddr . tcp dport map { 10.1.1.136 . 80 : 1.1.2.69 . 1024,   10.1.1.10-10.1.1.20 . 8888-8889 : 1.1.2.69 . 2048-2049 } persistent       }    }\n<li class=\"l\"> \u00c8 stata aggiunta la supporto per l'espressione \u00ablast\u00bb, che consente di conoscere il tempo dell'ultimo utilizzo di un elemento della regola o dell'elenco set. Questa funzionalit\u00e0 \u00e8 supportata a partire dal kernel Linux 5.14.        table ip x {        set y {            typeof ip daddr . tcp dport            size 65535            flags dynamic,timeout            last            timeout 1h        }          chain z {            type filter hook output priority filter; policy accept;            update @y { ip daddr . tcp dport }        }    }      # nft list set ip x y    table ip x {        set y {            typeof ip daddr . tcp dport            size 65535            flags dynamic,timeout            last            timeout 1h            elements = { 172.217.17.14 . 443 last used 1s591ms timeout 1h expires 59m58s409ms,                         172.67.69.19 . 443 last used 4s636ms timeout 1h expires 59m55s364ms,                         142.250.201.72 . 443 last used 4s748ms timeout 1h expires 59m55s252ms,                         172.67.70.134 . 443 last used 4s688ms timeout 1h expires 59m55s312ms,                         35.241.9.150 . 443 last used 5s204ms timeout 1h expires 59m54s796ms,                         138.201.122.174 . 443 last used 4s537ms timeout 1h expires 59m55s463ms,                         34.160.144.191 . 443 last used 5s205ms timeout 1h expires 59m54s795ms,                         130.211.23.194 . 443 last used 4s436ms timeout 1h expires 59m55s564ms }           }    }\n<li class=\"l\"> \u00c8 stata aggiunta la possibilit\u00e0 di determinare le quote negli elenchi set. Ad esempio, per impostare una quota sul traffico per ogni indirizzo IP di destinazione, si pu\u00f2 specificare:      table netdev x {        set y {            typeof ip daddr            size 65535            quota over 10000 mbytes        }          chain y {            type filter hook egress device \u00abeth0\u00bb priority filter; policy accept;            ip daddr @y drop        }    }      # nft add element inet x y { 8.8.8.8 }    # ping -c 2 8.8.8.8       # nft list ruleset    table netdev x {        set y {            type ipv4_addr            size 65535            quota over 10000 mbytes            elements = { 8.8.8.8 quota over 10000 mbytes used 196 bytes }        }          chain y {            type filter hook egress device \u00abeth0\u00bb priority filter; policy accept;            ip daddr @y drop        }    }\n<li class=\"l\"> \u00c8 consentito l'uso delle costanti nelle set-list. Ad esempio, quando si utilizza come chiave della lista l'indirizzo di destinazione e l'identificatore VLAN, \u00e8 possibile specificare direttamente il numero VLAN (daddr . 123):          table netdev t {            set s {                typeof ether saddr . vlan id                size 2048                flags dynamic,timeout                timeout 1m            }              chain c {                type filter hook ingress device eth0 priority 0; policy accept;                ether type != 8021q update @s { ether daddr . 123 } counter            }        }\n<li class=\"l\"> \u00c8 stato introdotto un nuovo comando \u00abdestroy\u00bb per la rimozione incondizionata degli oggetti (a differenza del comando delete, non genera ENOENT quando si tenta di rimuovere un oggetto assente). Per funzionare, \u00e8 necessario almeno il kernel Linux 6.3-rc.         destroy table ip filter        <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58791\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107267","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-14T10:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-15T17:12:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Versione del filtro a pacchetto nftables 1.0.7 | ProHoster","description":"\u00c8 stata pubblicata la versione del filtro pacchetti nftables 1.0.7, che unifica le interfacce di filtraggio dei pacchetti per IPv4, IPv6, ARP e bridge di rete (mirato a sostituire iptables, ip6tables, arptables ed ebtables).","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-14T10:48:14+00:00","article:modified_time":"2023-03-15T17:12:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"107267","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:08","updated":"2026-02-08 20:24:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=107267"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107267\/revisions"}],"predecessor-version":[{"id":164210,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/107267\/revisions\/164210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=107267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=107267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=107267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}