{"id":37278,"date":"2019-10-31T22:16:45","date_gmt":"2019-10-31T19:16:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-paketnogo-filtra-nftables-0-9-2\/"},"modified":"2019-10-31T22:16:45","modified_gmt":"2019-10-31T19:16:45","slug":"vypusk-paketnogo-filtra-nftables-0-9-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","title":{"rendered":"Utgivning av paketfiltret nftables 0.9.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=156621590113089&#038;w=2\">H\u00e4ndelse genomf\u00f6rd<\/a><\/noindex> utg\u00e5van av paketfilter <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.2<\/a><\/noindex>, som utvecklas som en ers\u00e4ttning f\u00f6r iptables, ip6tables, arptables och ebtables genom att enhetligg\u00f6ra gr\u00e4nssnitten f\u00f6r paketfiltrering f\u00f6r IPv4, IPv6, ARP och n\u00e4tverksbroar. Paketet nftables inneh\u00e5ller komponenter av paketfilter som fungerar i anv\u00e4ndarrummet, medan k\u00e4rnniv\u00e5n hanteras av nf_tables-subsystemet, som ing\u00e5r i Linux-k\u00e4rnan sedan version 3.13. De f\u00f6r\u00e4ndringar som kr\u00e4vs f\u00f6r nftables 0.9.2 ing\u00e5r i Linux-k\u00e4rnan 5.3.<\/p>\n<p>I k\u00e4rnniv\u00e5n tillhandah\u00e5lls bara ett allm\u00e4nt gr\u00e4nssnitt som inte \u00e4r beroende av ett specifikt protokoll och som erbjuder grundl\u00e4ggande funktioner f\u00f6r att extrahera data fr\u00e5n paket, utf\u00f6ra operationer med data och hantera fl\u00f6den. Sj\u00e4lva filtreringslogiken och protokollspecifika bearbetare kompileras till bytekod i anv\u00e4ndarrummet, vilken laddas i k\u00e4rnan via Netlink-gr\u00e4nssnittet och k\u00f6rs i en speciell virtuell maskin som p\u00e5minner om BPF (Berkeley Packet Filters). Denna metod m\u00f6jligg\u00f6r en betydande minskning av kodstorleken f\u00f6r filtrering som k\u00f6rs p\u00e5 k\u00e4rnniv\u00e5 och flyttar alla funktioner f\u00f6r regelanalys och protokollhantering till anv\u00e4ndarrummet.<\/p>\n<p>Huvudsakliga nyheter:<\/p>\n<ul>\n<li class=\"l\"> M\u00f6jlighet att kontrollera portnumret fr\u00e5n transportlagsheadern oberoende av typ av protokoll f\u00f6r niv\u00e5 4:\n<p>   add rule x y ip protocol { tcp, udp } th dport 53<\/p>\n<li class=\"l\"> St\u00f6d f\u00f6r att \u00e5terst\u00e4lla livsl\u00e4ngden p\u00e5 en upps\u00e4ttning element:\n<p>   add element ip x y { 1.1.1.1 timeout 30s expires 15s }<\/p>\n<li class=\"l\"> M\u00f6jlighet att kontrollera vissa alternativ (lsrr, rr, ssrr och ra) fr\u00e5n IPv4-paket:\n<p>   add rule x y ip option rr exists drop<\/p>\n<p>F\u00f6r routingalternativ \u00e4r det m\u00f6jligt att kontrollera f\u00e4lten type, ptr, length och addr:<\/p>\n<p>   add rule x y ip option rr type 1 drop<\/p>\n<li class=\"l\"> I uttryck \u00e4r det nu till\u00e5tet att ange n\u00e4tverksprefix och adressintervall:\n<p>   iifname ens3 snat to 10.0.0.0\/28<br \/>\n   iifname ens3 snat to 10.0.0.1-10.0.0.15<\/p>\n<li class=\"l\"> St\u00f6d f\u00f6r att anv\u00e4nda variabler i kedjedefinitioner:\n<p>    define default_policy = accept<br \/>\n    add chain ip foo bar { type filter hook input priority filter; policy $default_policy }<\/p>\n<li class=\"l\"> Specificering av kedjans prioritet kan nu g\u00f6ras b\u00e5de i numeriskt och symboliskt format:\n<p>    define prio = filter<br \/>\n    define prionum = 10<br \/>\n    define prioffset = &#171;filter &#8212; 150&#187;<\/p>\n<p>    add table ip foo<br \/>\n    add chain ip foo bar { type filter hook input priority $prio; }<br \/>\n    add chain ip foo ber { type filter hook input priority $prionum; }<br \/>\n    add chain ip foo bor { type filter hook input priority $prioffset; }<\/p>\n<li class=\"l\"> St\u00f6d f\u00f6r synproxy-modulen har implementerats. Till exempel, f\u00f6r att skydda TCP-port 8888 under synproxy kan f\u00f6ljande upps\u00e4ttning regler anv\u00e4ndas:\n<p>    table ip x {<br \/>\n            chain y {<br \/>\n                    typ filter hook prerouting prioritet raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            chain z {<br \/>\n                    typ filter hook forward prioritet filter; policy accept;<br \/>\n                    tcp dport 8888 ct state invalid,untracked synproxy mss 1460 &#92;&#92;<br \/>\n                       wscale 7 timestamp sack-perm ct state invalid drop<br \/>\n            }<br \/>\n    }<\/p>\n<li class=\"l\"> F\u00f6r att definiera i conntrack-tabellen de f\u00f6rv\u00e4ntade ytterligare anslutningar relaterade till den aktuella anslutningen, som till\u00e4mpas i protokoll och scenarier som kr\u00e4ver att flera anslutningar uppr\u00e4ttas, kan policys nu definieras genom standard upps\u00e4ttningar av regler. Till exempel, f\u00f6r att definiera de f\u00f6rv\u00e4ntade efterf\u00f6ljande anslutningarna till TCP-port 8888 och till port 5432 kan f\u00f6ljande regler anges:\n<p>        tabell x {<br \/>\n                ct expectation myexpect {<br \/>\n                        protokoll tcp<br \/>\n                        dport 5432<br \/>\n                        timeout 1h<br \/>\n                        storlek 12<br \/>\n                        l3proto ip<br \/>\n                }<\/p>\n<p>                kedja input {<br \/>\n                        typ filter hook input prioritet 0;<br \/>\n                        ct state new tcp dport 8888 ct expectation set myexpect<br \/>\n                        ct state established,related counter accept<br \/>\n                }<br \/>\n        }<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51312\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Utg\u00e5van av paketfiltren nftables 0.9.2 | ProHoster","description":"Det har skett en release av paketfiltren","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.2 | ProHoster","og:description":"\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:45+00:00","article:modified_time":"2019-10-31T19:16:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:04:39","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:30:00","updated":"2026-01-23 17:04:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=37278"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37278\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=37278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=37278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=37278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}