{"id":107267,"date":"2023-03-14T12:48:14","date_gmt":"2023-03-14T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=107267"},"modified":"2023-03-15T19:12:55","modified_gmt":"2023-03-15T17:12:55","slug":"vypusk-paketnogo-filtra-nftables-1-0-7","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","title":{"rendered":"Utgivning av paketfiltret nftables 1.0.7","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Utg\u00e5van av nftables paketfilter 1.0.7 har publicerats, vilket enar gr\u00e4nssnitten f\u00f6r paketfiltrering f\u00f6r IPv4, IPv6, ARP och n\u00e4tverksbroar (inriktad p\u00e5 att ers\u00e4tta iptables, ip6tables, arptables och ebtables). Nftables-paketet inneh\u00e5ller komponenter f\u00f6r paketfilter som arbetar i anv\u00e4ndarutrymmet, medan k\u00e4rnniv\u00e5ns arbete tillhandah\u00e5lls av delsystemet nf_tables, som ing\u00e5r i Linux-k\u00e4rnan fr\u00e5n version 3.13. P\u00e5 k\u00e4rnniv\u00e5 tillhandah\u00e5lls endast ett allm\u00e4nt gr\u00e4nssnitt som inte \u00e4r beroende av n\u00e5got specifikt protokoll och som erbjuder grundl\u00e4ggande funktioner f\u00f6r datautvinning fr\u00e5n paket, databehandling och str\u00f6mhantering.    <\/p>\n<p>Sj\u00e4lva filtreringsreglerna och protokollspecifika hanterare kompileras till bytekod i anv\u00e4ndarrummet, som sedan laddas in i k\u00e4rnan via Netlink-gr\u00e4nssnittet och utf\u00f6rs i k\u00e4rnan i en speciell <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/vps\/abuzoustojchivye-vps\/\"   title=\"en virtuell maskin\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4335\">en virtuell maskin<\/a>, liknande BPF (Berkeley Packet Filters). Denna metod g\u00f6r det m\u00f6jligt att avsev\u00e4rt minska storleken p\u00e5 den filterkod som k\u00f6rs p\u00e5 k\u00e4rnniv\u00e5 och flytta alla funktioner f\u00f6r tolkning av regler och logik som r\u00f6r protokoll till anv\u00e4ndarrummet.    <\/p>\n<p>Huvudsakliga f\u00f6r\u00e4ndringar:  <\/p>\n<ul>\n<li class=\"l\"> F\u00f6r system med Linux-k\u00e4rna 6.2+ har st\u00f6d f\u00f6r protokollavst\u00e4mning av vxlan, geneve, gre och gretap lagts till, vilket m\u00f6jligg\u00f6r anv\u00e4ndning av enkla uttryck f\u00f6r att kontrollera rubriker i inkapslade paket. Till exempel f\u00f6r att kontrollera <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/lir\/ipv4\/\"   title=\"IP-adresser\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"711\">IP-adresser<\/a> I header f\u00f6r det inb\u00e4ddade paketet fr\u00e5n VxLAN kan man nu anv\u00e4nda regler (utan behov av f\u00f6rhandsavkapsling av VxLAN-headern och koppling av filter till gr\u00e4nssnittet vxlan0):          \u2026 udp dport 4789 vxlan ip-protokoll udp        \u2026 udp dport 4789 vxlan ip saddr 1.2.3.0\/24        \u2026 udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 }\n<li class=\"l\"> St\u00f6d f\u00f6r automatisk sammanslagning av rester efter partiell borttagning av element ur set-listan har implementerats, vilket g\u00f6r det m\u00f6jligt att ta bort ett element eller en del av en intervall fr\u00e5n ett befintligt intervall (tidigare kunde ett intervall endast tas bort helt). Till exempel, efter att ha tagit bort element 25 fr\u00e5n set-listan med intervall 24-30 och 40-50, kommer listan att inneh\u00e5lla 24, 26-30 och 40-50. Korrigeringar som beh\u00f6vs f\u00f6r att aktivera automatiskt sammanslagning kommer att erbjudas i korrigerande utg\u00e5vor av stabila k\u00e4rnversioner 5.10+.              # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24-30, 40-50 }            }        }          # nft delete element ip x y { 25 }          # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24, 26-30, 40-50 }            }        }\n<li class=\"l\"> Anv\u00e4ndning av kontaktpunkter och intervall f\u00f6r adresstranslation (NAT) har godk\u00e4nts.      table ip nat {        chain prerouting {            type nat hook prerouting priority dstnat; policy accept;            dnat to ip daddr . tcp dport map { 10.1.1.136 . 80 : 1.1.2.69 . 1024,   10.1.1.10-10.1.1.20 . 8888-8889 : 1.1.2.69 . 2048-2049 } persistent       }    }\n<li class=\"l\"> St\u00f6d f\u00f6r uttrycket \u00ablast\u00bb har lagts till, vilket g\u00f6r det m\u00f6jligt att ta reda p\u00e5 n\u00e4r ett regel- eller set-element senast anv\u00e4ndes. Denna funktion st\u00f6ds fr\u00e5n och med Linux-k\u00e4rna 5.14.        table ip x {        set y {            typeof ip daddr . tcp dport            size 65535            flags dynamic,timeout            last            timeout 1h        }          chain z {            type filter hook output priority filter; policy accept;            update @y { ip daddr . tcp dport }        }    }      # nft list set ip x y    table ip x {        set y {            typeof ip daddr . tcp dport            size 65535            flags dynamic,timeout            last            timeout 1h            elements = { 172.217.17.14 . 443 last used 1s591ms timeout 1h expires 59m58s409ms,                         172.67.69.19 . 443 last used 4s636ms timeout 1h expires 59m55s364ms,                         142.250.201.72 . 443 last used 4s748ms timeout 1h expires 59m55s252ms,                         172.67.70.134 . 443 last used 4s688ms timeout 1h expires 59m55s312ms,                         35.241.9.150 . 443 last used 5s204ms timeout 1h expires 59m54s796ms,                         138.201.122.174 . 443 last used 4s537ms timeout 1h expires 59m55s463ms,                         34.160.144.191 . 443 last used 5s205ms timeout 1h expires 59m54s795ms,                         130.211.23.194 . 443 last used 4s436ms timeout 1h expires 59m55s564ms }           }    }\n<li class=\"l\"> M\u00f6jlighet att definiera kvoter i set-listor har lagts till. Till exempel, f\u00f6r att definiera en kvot f\u00f6r trafik f\u00f6r varje m\u00e5lad IP-adress kan man ange:      table netdev x {        set y {            typeof ip daddr            size 65535            quota over 10000 mbytes        }          chain y {            type filter hook egress device \u00abeth0\u00bb priority filter; policy accept;            ip daddr @y drop        }    }      # nft add element inet x y { 8.8.8.8 }    # ping -c 2 8.8.8.8       # nft list ruleset    table netdev x {        set y {            type ipv4_addr            size 65535            quota over 10000 mbytes            elements = { 8.8.8.8 quota over 10000 mbytes used 196 bytes }        }          chain y {            type filter hook egress device \u00abeth0\u00bb priority filter; policy accept;            ip daddr @y drop        }    }\n<li class=\"l\"> Anv\u00e4ndning av konstanter i set-listor har till\u00e5tits. Till exempel, n\u00e4r man anv\u00e4nder destinationsadressen och VLAN-ID som nyckel i listan kan man direkt ange VLAN-numret (daddr . 123):          table netdev t {            set s {                typeof ether saddr . vlan id                size 2048                flags dynamic,timeout                timeout 1m            }              chain c {                type filter hook ingress device eth0 priority 0; policy accept;                ether type != 8021q update @s { ether daddr . 123 } counter            }        }\n<li class=\"l\"> Ett nytt kommando \u00abdestroy\u00bb har lagts till f\u00f6r okomplicerat radering av objekt (till skillnad fr\u00e5n kommandot delete, som inte genererar ENOENT vid f\u00f6rs\u00f6k att radera ett icke-existerande objekt). F\u00f6r att fungera kr\u00e4vs minst Linux-k\u00e4na 6.3-rc.         destroy table ip filter        <\/ul>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58791\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107267","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-14T10:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-15T17:12:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Utg\u00e5van av paketfiltren nftables 1.0.7 | ProHoster","description":"Utg\u00e5van av paketfilter nftables 1.0.7 har publicerats, vilket f\u00f6renar gr\u00e4nssnitten f\u00f6r paketfiltering f\u00f6r IPv4, IPv6, ARP och n\u00e4tverksbroar (siktar p\u00e5 att ers\u00e4tta iptables, ip6tables, arptables och ebtables).","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-14T10:48:14+00:00","article:modified_time":"2023-03-15T17:12:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"107267","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:08","updated":"2026-02-08 20:24:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/107267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=107267"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/107267\/revisions"}],"predecessor-version":[{"id":164210,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/107267\/revisions\/164210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=107267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=107267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=107267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}