ืื ืืขืืืื ื ืคืื ืคึผืึทืงืึทื ืคืืืืขืจ ื ืคืืึทืืืขืก 1.0.6 ืืื ืืจืืืก, ืืื ืึทืคืืืื ื ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื ืื ืืขืจืคืืืกืื ืคึฟืึทืจ IPv4, IPv6, ARP ืืื ื ืขืฅ ืืจืืงื (ืึทืืืขื ืฆื ืคืึทืจืืืึทืื ืืคึผืืึทืืืขืก, ืืคึผ6ืืึทืืืข, ืึทืจืคึผืืึทืืืขืก ืืื ืขืืืึทืืืขืก). ืื nftables ืคึผืขืงื ืืืื ืคึผืึทืงืึทื ืคืืืืขืจ ืงืึทืืคึผืึธืื ืึทื ืฅ ืืืึธืก ืืืืคื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ืืฉืขืช ืื ืงืขืจื-ืืืจืื ืึทืจืืขื ืืื ืฆืืืขืฉืืขืื ืืืจื ืื nf_tables ืกืึทืืกืืกืืึทื, ืืืึธืก ืืื ืืขืืืขื ืืืื ืคืื ืื ืืื ืืงืก ืงืขืจื ืืื ื ืืขืืืื ื 3.13. ืืขืจ ืงืขืจื ืืืจืื ืืื ืืืืื ืึท ืืืฉืึทื ืขืจืืง ืคึผืจืึธืืึธืงืึธื-ืคืจืืึท ืฆืืืื ื ืืืึธืก ืืื ืืงืขืจืืืง ืคืึทื ืืงืฉืึทื ื ืคึฟืึทืจ ืืงืกืืจืึทืงืืื ื ืืึทืื ืคืื ืคึผืึทืงืืฅ, ืคึผืขืจืคืึธืจืืื ื ืืึทืื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืืืืคื ืงืึธื ืืจืึธื.
ืื ืคึฟืืืืจืืจืื ื ืึผืืืื ืืื ืคึผืจืึธืืึธืงืึธื-ืกืคึผืขืฆืืคืืฉ ืืึทื ืืืขืจืก ืืขื ืขื ืงืึทืืคึผืืืื ืืื ืืืืขืงืึธืืข ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ื ืึธื ืืืึธืก ืืขื ืืืืืขืงืึธื ืืื ืืึธืืืื ืืื ืื ืงืขืจื ื ืืฆื ืื ื ืขืืืื ืง ืฆืืืื ื ืืื ืขืงืกืึทืงืืืืึทื ืืื ืื ืงืขืจื ืืื ืึท ืกืคึผืขืฆืืขื ืืืืจืืืึทื ืืึทืฉืื ืจืขืืึทื ืืกืึทื ื ืคืื BPF (Berkeley Packet Filters). ืืขืจ ืฆืืืึทื ื ืึทืืึทืื ืืืจ ืฆื ืืืืืืืืง ืจืขืืืฆืืจื ืื ืืจืืืก ืคืื ืื ืคึฟืืืืจืืจืื ื ืงืึธื ืคืืืกื ืืืง ืืืืฃ ืื ืงืขืจื ืืืจืื ืืื ืืึทื ืึทืืข ืื ืคืึทื ืืงืฉืึทื ื ืคืื ืคึผืึทืจืกืื ื ืึผืืืื ืืื ืืึธืืืง ืคึฟืึทืจ ืืจืืขืื ืืื ืคึผืจืึธืืึธืงืึธืืก ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืืืืคึผื ืขื ืืขืจืื ืืขื:
- ืื ืึผืืืื ืึธืคึผืืืืืืขืจ, ืืขืจืืคื ืืืขื ืื "-ืึธ / - ืึธืคึผืืืืืืข" ืึธืคึผืฆืืข ืืื ืกืคึผืขืกืืคืืขื, ืืื ืึธืืึทืืึทืืืง ืคึผืึทืงืืืืฉืื ื ืคืื ืึผืืืื ืืืจื ืงืึทืืืืื ืื ื ืืื ืืื ืงืึทื ืืืขืจืืื ื ืืื ืืื ืืึทืคึผืข ืืื ืฉืืขืื ืจืฉืืืืช. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืึผืืืื # cat ruleset.nft ืืืฉ ืืคึผ ืจืขื ืืืขื { ืงืืื ื {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื ืคืืืืขืจ; ืคึผืึธืืืืืง ืคืึทืื; meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.4 accept meta iifname eth1 ip saddr 1.1.1.2 ip saddr 2.2.3.0 ip daddr .24 .1 ip daddr 1.1.1.2-2.2.4.0 accept meta iifname eth2.2.4.10 ip saddr 2 ip daddr 1.1.1.3 accept } } ื ืึธื ืขืงืกืึทืงืืืืื ื "nft -o -c -f ruleset.nft" ืืืขื ืืืื ืงืึธื ืืืขืจืืขื ืฆื ืืื ืืืื: ืึผืืืื nft:2.2.2.5:4-17: meta iifname eth74 ip saddr 1 ip daddr 1.1.1.1 accept ruleset.nft:2.2.2.3:5-17: meta iifname eth74 ip saddr 1 ip daddr 1.1.1.2.n accept ruleset. : 2.2.2.4:6-17: meta iifname eth77 ip saddr 1 ip daddr 1.1.1.2/2.2.3.0 accept ruleset.nft:24:7-17: meta iifname eth83 ip saddr 1 ip daddr 1.1.1.2. ืึธื ื ืขืืขื Ruleset.nft:2.2.4.0:2.2.4.10-8: ืืขืืึท ืืืคื ืึทืืข ืขืื17 ืืคึผ ืกืึทืืจ 74 ืืคึผ ืืึทืืืจ 2 ืึธื ื ืขืืขื ืืื: ืืืคื ืึทืืข. ip saddr. ืืคึผ ืืึทืืืจ {ืขืื1.1.1.3. 2.2.2.5. 1, ืขืื1.1.1.1. 2.2.2.3. 1, ืขืื1.1.1.2. 2.2.2.4. 1/1.1.1.2, ืขืื2.2.3.0. 24. 1-1.1.1.2, ืขืื2.2.4.0. 2.2.4.10. 2 } ืึธื ื ืขืืขื
- ืื ืึธืคึผืืืืืืขืจ ืงืขื ืขื ืืืื ืืขืจ ืึผืืืื ืืืึธืก ืฉืืื ื ืืฆื ืคึผืฉืื ืฉืืขืื ืจืฉืืืืช ืืื ืึท ืืขืจ ืกืึธืืื ืคืึธืจืขื, ืืืฉื ืื ืึผืืืื: # cat ruleset.nft ืืืฉ ืืคึผ ืคืืืืขืจ { ืงืืื ืึทืจืืึทื ืฉืจืืึทื { ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื ืคืืืืขืจ; ืคึผืึธืืืืืง ืคืึทืื; iifname "ืืึธ" ืึธื ื ืขืืขื ืงื ืฉืืึทื ืืขืืจืื ืืขื, ืคึฟืึทืจืืื ืืขื ืข ืึธื ื ืขืืขื ืืึทืืขืจืงืื ื "ืืื ืคืึทืจืงืขืจ ืืืจ ืงืืืขื, ืืืจ ืฆืืืจืื" iifname "enp0s31f6" ip saddr {209.115.181.102, 216.197.228.230} ip daddr 10.0.0.149 udp sport 123 ืืืคึผ 32768 iifname "enp65535s0f31" ip saddr {6, 64.59.144.17} ip daddr 64.59.150.133 udp sport 10.0.0.149 udp dport 53-32768 ืึธื ื ืขืืขื } } ื ืึธื ืขืงืกืึทืงืืืืื ื. -nft ืคึผืขืงื : ruleset.nft:65535:6-22: iifname "enp149s0f31" ip saddr {6, 209.115.181.102} ip daddr 216.197.228.230 ืืืคึผ ืกืคึผืึธืจื 10.0.0.149, 123 32768 : iifname "enp65535s7f22" ip saddr {143, 0} ip daddr 31 udp sport 6 udp dport 64.59.144.17-64.59.150.133 accept into: iifname. ip saddr. ip daddr. udp sport. udp dport {enp10.0.0.149s53f32768. 65535. 0. 31 . 6-209.115.181.102, enp10.0.0.149s123f32768. 65535. 0. 31 . 6-216.197.228.230, enp10.0.0.149s123f32768. 65535. 0. 31 . 6-64.59.144.17, enp10.0.0.149s53f32768. 65535. 0. 31 . 6-64.59.150.133 } ืึธื ื ืขืืขื
- ืกืึทืืืื ืคึผืจืึธืืืขื ืืื ืืืืืขืงืึธืืข ืืืจ ืคึฟืึทืจ ืืขืจืืืฉืื ื ืื ืืขืจืืืึทืื ืืืึธืก ื ืืฆื ืืืืคึผืก ืืื ืคืึทืจืฉืืืขื ืข ืืืื ืกืืจ, ืึทืืึท ืืื IPv4 (ื ืขืฅ ืืืื ืกืืจ) ืืื ืืขืืึท ืืืจืง (ืกืืกืืขื ืืืื ืกืืจ). ืืืฉ ืืคึผ ืจืขื ืืืขื { ืืึทืคึผืข ืื { ืืืคึผ ืคืื ืืคึผ ืกืึทืืจ . ืืขืืึท ืฆืืืื: ืืืขืจืืืงื ืคืืึทืืก ืื ืืขืจืืืึทื ืืึธืืืึทื ืง ืขืืขืืขื ืื = {127.0.0.1-127.0.0.4. 0x123434-0xb00122: ืึธื ื ืขืืขื, 192.168.0.10-192.168.1.20. 0x0000aa00-0x0000aaff: ืึธื ื ืขืืขื,}} ืงืืื ืง {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื ืคืืืืขืจ; ืคึผืึธืืืืืง ืคืึทืื; ip saddr. ืืขืืึท ืืืจืง ืืืืึทืคึผ @ืื } }
- ืืืคึผืจืืืื ืคืึทืจืืืืึทื ืคืื ืืขืืื ืคึผืจืึธืืึธืงืึธืืก ืืืขื ื ืืฆื ืจืื ืืืืกืืจืืงื, ืืืฉื: meta l4proto 91 @th,400,16 0x0 accept
- ืคึผืจืึธืืืขืืก ืืื ืขื ืืืืึทืืื ื ืึผืืืื ืืื ืื ืืขืจืืืึทืื ืืึธืื ืฉืืื ืจืืืึทืืืื: ืึทืจืืึทื ืืืืื ืืขืจืฉื xy tcp sport {3478-3497, 16384-16387} ืืึธืืืึทื ืง ืึธื ื ืขืืขื
- ืื JSON API ืืื ืืืคึผืจืืืื ืฆื ืึทืจืืึทื ื ืขืืขื ืฉืืืฆื ืคึฟืึทืจ ืืืืกืืจืืงื ืืื ืฉืืขืื ืืื ืืึทืคึผืข ืจืฉืืืืช.
- ืืงืกืืขื ืฉืึทื ื ืฆื ืื nftables ืคึผืืืืึธื ืืืืืืึธืืขืง ืืึธืื ืืึธืืืื ื ืคืื ืืขืจืฉื ืฉืืขืื ืคึฟืึทืจ ืคึผืจืึทืกืขืกืื ื ืืื ืืืึทืืึทืืืืฉืึทื ืืึธืืข ("-C") ืืื ืืืืื ืฉืืืฆื ืคึฟืึทืจ ืคืื ืืจืืืกื ืืืง ืืขืคึฟืื ืืฆืืข ืคืื โโืืืขืจืืึทืืึทืื.
- ืึทืืื ื ืืึทืืขืจืงืื ืืขื ืืื ืขืจืืืืื ืืื ืฉืืขืื ืจืฉืืื ืขืืขืืขื ืื.
- ืืืืืข ืจืึทืืขืืืืื ืึทืืึทืื ืกืคึผืขืฆืืคืืฆืืจื ืึท ื ืื ืืืขืจื.
ืืงืืจ: opennet.ru