{"id":37278,"date":"2019-10-31T22:16:45","date_gmt":"2019-10-31T19:16:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-paketnogo-filtra-nftables-0-9-2\/"},"modified":"2019-10-31T22:16:45","modified_gmt":"2019-10-31T19:16:45","slug":"vypusk-paketnogo-filtra-nftables-0-9-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","title":{"rendered":"Wydanie pakietowego filtra nftables 0.9.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=156621590113089&#038;w=2\">Zdarzy\u0142o si\u0119<\/a><\/noindex> wydanie pakietowego filtra <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.2<\/a><\/noindex>, rozwijaj\u0105cego si\u0119 jako zamiennik iptables, ip6tables, arptables i ebtables poprzez unifikacj\u0119 interfejs\u00f3w filtrowania pakiet\u00f3w dla IPv4, IPv6, ARP i most\u00f3w sieciowych. Pakiet nftables zawiera komponenty filtra pakiet\u00f3w dzia\u0142aj\u0105ce w przestrzeni u\u017cytkownika, podczas gdy na poziomie j\u0105dra dzia\u0142a podsystem nf_tables, kt\u00f3ry jest cz\u0119\u015bci\u0105 j\u0105dra Linux od wydania 3.13. Niezb\u0119dne do dzia\u0142ania wydania nftables 0.9.2 zmiany s\u0105 zawarte w j\u0105drze Linux 5.3.<\/p>\n<p>Na poziomie j\u0105dra udost\u0119pniany jest jedynie og\u00f3lny interfejs, niezale\u017cny od konkretnego protoko\u0142u, kt\u00f3ry zapewnia podstawowe funkcje wyodr\u0119bniania danych z pakiet\u00f3w, wykonywania operacji na danych i zarz\u0105dzania ruchem. Logika filtrowania oraz specyficzne dla protoko\u0142\u00f3w przetwarzacze s\u0105 kompilowane do bajtkodu w przestrzeni u\u017cytkownika, a nast\u0119pnie ten bajtkod jest \u0142adowany do j\u0105dra za pomoc\u0105 interfejsu Netlink i wykonywany w specjalnej maszynie wirtualnej, przypominaj\u0105cej BPF (Berkeley Packet Filters). Tego rodzaju podej\u015bcie pozwala znacznie zmniejszy\u0107 rozmiar kodu filtrowania dzia\u0142aj\u0105cego na poziomie j\u0105dra oraz przenie\u015b\u0107 wszystkie funkcje analizy regu\u0142 i logiki obs\u0142ugi protoko\u0142\u00f3w do przestrzeni u\u017cytkownika.<\/p>\n<p>G\u0142\u00f3wne nowo\u015bci:<\/p>\n<ul>\n<li class=\"l\"> Mo\u017cliwo\u015b\u0107 sprawdzenia numeru portu z nag\u0142\u00f3wka pakietu warstwy transportowej, niezale\u017cnie od typu protoko\u0142u warstwy 4:\n<p>   add rule x y ip protocol { tcp, udp } th dport 53<\/p>\n<li class=\"l\"> Wsparcie dla przywracania czasu \u017cycia zestawu element\u00f3w:\n<p>   add element ip x y { 1.1.1.1 timeout 30s expires 15s }<\/p>\n<li class=\"l\"> Mo\u017cliwo\u015b\u0107 sprawdzenia pojedynczych opcji (lsrr, rr, ssrr i ra) z pakiet\u00f3w IPv4:\n<p>   add rule x y ip option rr exists drop<\/p>\n<p>Dla opcji routingu mo\u017cliwa jest kontrola p\u00f3l type, ptr, length i addr:<\/p>\n<p>   add rule x y ip option rr type 1 drop<\/p>\n<li class=\"l\"> W wyra\u017ceniach teraz dozwolone jest wskazywanie prefiks\u00f3w sieciowych i zakres\u00f3w adres\u00f3w:\n<p>   iifname ens3 snat to 10.0.0.0\/28<br \/>\n   iifname ens3 snat to 10.0.0.1-10.0.0.15<\/p>\n<li class=\"l\"> Wsparcie dla u\u017cycia zmiennych w definicjach \u0142a\u0144cuch\u00f3w:\n<p>    define default_policy = accept<br \/>\n    add chain ip foo bar { type filter hook input priority filter; policy $default_policy }<\/p>\n<li class=\"l\"> Okre\u015blenie priorytetu \u0142a\u0144cucha mo\u017ce teraz odbywa\u0107 si\u0119 zar\u00f3wno w formie numerycznej, jak i symbolicznej:\n<p>    define prio = filter<br \/>\n    define prionum = 10<br \/>\n    zdefiniuj prioffset = \u201efiltr \u2014 150\u201d<\/p>\n<p>    add table ip foo<br \/>\n    add chain ip foo bar { type filter hook input priority $prio; }<br \/>\n    add chain ip foo ber { type filter hook input priority $prionum; }<br \/>\n    add chain ip foo bor { type filter hook input priority $prioffset; }<\/p>\n<li class=\"l\"> Zosta\u0142o wprowadzone wsparcie dla modu\u0142u synproxy. Na przyk\u0142ad, aby zabezpieczy\u0107 port TCP 8888 przy u\u017cyciu synproxy, mo\u017cna zastosowa\u0107 nast\u0119puj\u0105cy zestaw regu\u0142:\n<p>    table ip x {<br \/>\n            chain y {<br \/>\n                    type filter hook prerouting priority raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            chain z {<br \/>\n                    type filter hook forward priority filter; policy accept;<br \/>\n                    tcp dport 8888 ct stan nieprawid\u0142owy, nie\u015bledzony synproxy mss 1460 \\<br \/>\n                       wscale 7 timestamp sack-perm ct state invalid drop<br \/>\n            }<br \/>\n    }<\/p>\n<li class=\"l\"> Aby okre\u015bli\u0107 w tabeli conntrack powi\u0105zane z bie\u017c\u0105cym po\u0142\u0105czeniem oczekiwane dodatkowe po\u0142\u0105czenia, kt\u00f3re s\u0105 stosowane w protoko\u0142ach i scenariuszach wymagaj\u0105cych nawi\u0105zania wielu po\u0142\u0105cze\u0144, mo\u017cna teraz definiowa\u0107 polityki przez standardowe zbiory regu\u0142. Na przyk\u0142ad, aby okre\u015bli\u0107 oczekiwane po\u0142\u0105czenia do portu TCP 8888 jako nast\u0119pne po\u0142\u0105czenia do portu 5432, mo\u017cna wskaza\u0107 nast\u0119puj\u0105ce regu\u0142y:\n<p>        table x {<br \/>\n                ct expectation myexpect {<br \/>\n                        protocol tcp<br \/>\n                        dport 5432<br \/>\n                        timeout 1h<br \/>\n                        size 12<br \/>\n                        l3proto ip<br \/>\n                }<\/p>\n<p>                chain input {<br \/>\n                        type filter hook input priority 0;<br \/>\n                        ct state new tcp dport 8888 ct expectation set myexpect<br \/>\n                        ct state established,related counter accept<br \/>\n                }<br \/>\n        }<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51312\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wydanie filtra pakiet\u00f3w nftables 0.9.2 | ProHoster","description":"Wydano filtr pakiet\u00f3w","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster","og:description":"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:45+00:00","article:modified_time":"2019-10-31T19:16:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:04:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:30:00","updated":"2026-01-23 17:04:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/37278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=37278"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/37278\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=37278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=37278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=37278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}