ื ืึธื ืึท ืืึธืจ ืคืื ืึทื ืืืืืงืืื ื ืคึผืึทืงืึทื ืคืืืืขืจ ืืขืืืื ื , ืืขืืืขืืึธืคึผืื ื ืืื ืึท ืคืึทืจืืืึทื ืคึฟืึทืจ ืืคึผืืึทืืืขืก, ืืคึผ6ืืึทืืืข, ืึทืจืคึผืืึทืืืขืก ืืื ืขืืืึทืืืขืก ืืืจื ืืื ืึทืคืืืื ื ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื ืื ืืขืจืคืืืกืื ืคึฟืึทืจ IPv4, IPv6, ARP ืืื ื ืขืฅ ืืจืืงื. ืื nftables ืคึผืขืงื ืืืื ืคึผืึทืงืึทื ืคืืืืขืจ ืงืึทืืคึผืึธืื ืึทื ืฅ ืืืึธืก ืืืืคื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ืืฉืขืช ืื ืงืขืจื-ืืืจืื ืึทืจืืขื ืืื ืฆืืืขืฉืืขืื ืืืจื ืื nf_tables ืกืึทืืกืืกืืึทื, ืืืึธืก ืืื ืืขืืืขื ืืืื ืคืื ืื ืืื ืืงืก ืงืขืจื ืืื ื ืืขืืืื ื 3.13.
ืืขืจ ืงืขืจื ืืืจืื ืืื ืืืืื ืึท ืืืฉืึทื ืขืจืืง ืคึผืจืึธืืึธืงืึธื-ืคืจืืึท ืฆืืืื ื ืืืึธืก ืืื ืืงืขืจืืืง ืคืึทื ืืงืฉืึทื ื ืคึฟืึทืจ ืืงืกืืจืึทืงืืื ื ืืึทืื ืคืื ืคึผืึทืงืืฅ, ืคึผืขืจืคืึธืจืืื ื ืืึทืื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืืืืคื ืงืึธื ืืจืึธื.
ืื ืคึฟืืืืจืืจืื ื ืืึธืืืง ืืื ืืื ืคึผืจืึธืืึธืงืึธื-ืกืคึผืขืฆืืคืืฉ ืืึทื ืืืขืจืก ืืขื ืขื ืงืึทืืคึผืืืื ืืื ืืืืขืงืึธืืข ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ื ืึธื ืืืึธืก ืืขื ืืืืืขืงืึธื ืืื ืืึธืืืื ืืื ืื ืงืขืจื ื ืืฆื ืื ื ืขืืืื ืง ืฆืืืื ื ืืื ืขืงืกืึทืงืืืืึทื ืืื ืึท ืกืคึผืขืฆืืขื ืืืืจืืืึทื ืืึทืฉืื ืจืขืืึทื ืืกืึทื ื ืคืื BPF (Berkeley Packet Filters). ืืขืจ ืฆืืืึทื ื ืึทืืึทืื ืืืจ ืฆื ืืืืืืืืง ืจืขืืืฆืืจื ืื ืืจืืืก ืคืื ืื ืคึฟืืืืจืืจืื ื ืงืึธื ืคืืืกื ืืืง ืืืืฃ ืื ืงืขืจื ืืืจืื ืืื ืืึทื ืึทืืข ืื ืคืึทื ืืงืฉืึทื ื ืคืื ืคึผืึทืจืกืื ื ืึผืืืื ืืื ืืึธืืืง ืคึฟืึทืจ ืืจืืขืื ืืื ืคึผืจืึธืืึธืงืึธืืก ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืืืืคึผื ืืืืืฉืื:
- IPsec ืฉืืืฆื, ืึทืืึทืืื ื ืืึทืืืฉืื ื ืคืื ืืื ืขื ืึทืืจืขืกืขืก ืืืืืจื ืืืืฃ ืคึผืึทืงืึทื, IPsec ืืขืื ืฉืืึทื ืืื SPI (ืกืขืงืืจืืื ืคึผืึทืจืึทืืขืืขืจ ืืื ืืขืงืก) ืงืืืืื. ืืืฉื,
... ipsec ืืื IP saddr 192.168.1.0/24
... ipsec ืืื ืกืคึผื 1-65536ืขืก ืืื ืืืื ืืขืืืขื ืฆื ืงืึธื ืืจืึธืืืจื ืฆื ืึท ืืึทืจืฉืจืื ืคึผืึทืกืื ืืืจื ืึทื IPsec ืืื ืขื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืคืึทืจืฉืคึผืึทืจื ืคืึทืจืงืขืจ ื ืืฉื ืืืจื IPSec:
โฆ ืคืืืืขืจ ืจืขืืืืืึทื ืจื ืืคึผืกืขืง ืคืขืื ืืืง ืงืึทืคึผ
- ืฉืืืฆื ืคึฟืึทืจ IGMP (Internet Group Management Protocol). ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจ ืงืขื ืขื ื ืืฆื ืึท ืืขืจืฉื ืฆื ืึทืืืขืงืืืึทืจืคื ืื ืงืึทืืื ื IGMP ืืจืืคึผืข ืืืืืืืืขืจืฉืึทืคื ืจืืงืืืขืก
nft add rule netdev foo bar igmp ืืืคึผ ืืืืืืืืขืจืฉืึทืคื-ืึธื ืคึฟืจืขื ืืึธืืืึทื ืง ืงืึทืคึผ
- ืืขืืืขืืงืืื ืคืื ื ืืฆื ืืืขืจืืึทืืึทืื ืฆื ืืขืคืื ืืจื ืืืขืจืืึทื ื ืงืืืื (ืฉืคึผืจืื ืืขื / ืืึธืืึธ). ืืืฉื:
ืืขืคืื ืืจื ืืขืกื = ืืขืจ
ืืืืื ืืขืจืฉื ืืคึผ ืคืึธืึธ ืืึทืจ ืฉืคึผืจืื ืืขื $ ืืขืกื - ืฉืืืฆื ืคึฟืึทืจ ืืึทืกืงืก ืฆื ืืืขื ืืืคืืฆืืจื ืึธืคึผืขืจืืืืื ื ืกืืกืืขืืขื (OS ืคืื ืืขืจืคึผืจืื ื) ืืืืืจื ืืืืฃ TTL ืืืึทืืืขืก ืืื ืื ืืขืืขืจ. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืฆืืืื ืคึผืึทืงืืฅ ืืืืืจื ืืืืฃ ืื ืกืขื ืืขืจ ืึทืก, ืืืจ ืงืขื ืขื ื ืืฆื ืื ืืึทืคึฟืขื:
... meta mark set osf ttl ืืึธืคึผืงืขื ื ืึธืืขื ืืึทืคึผืข {"ืืื ืืงืก": 0x1,
"ืืืื ืืึธืื": 0x2,
"ืืึทืงืึธืก": 0x3,
"ืืืืืึทืงืึทื ื": 0x0}
... osf ttl ืืึธืคึผืงืขื ืืืขืจืกืืข "ืืื ืืงืก:4.20" - ืคืืืืงืืื ืฆื ืืืืึทืื ืื ARP ืึทืืจืขืก ืคืื ืื ืกืขื ืืขืจ ืืื ืื IPv4 ืึทืืจืขืก ืคืื ืื ืฆืื ืกืืกืืขื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืคืึทืจืืจืขืกืขืจื ืื ืืึธืืืึทื ืง ืคืื ARP ืคึผืึทืงืืฅ ืืขืฉืืงื ืคึฟืื ืื ืึทืืจืขืก 192.168.2.1, ืืืจ ืงืขื ืขื ื ืืฆื ืื ืคืืืืขื ืืข ืืขืจืฉื:
ืืืฉ ืึทืจืคึผ ืจืขื ืืืขื {
ืงืืื ื {
ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื ืคืืืืขืจ; ืคึผืึธืืืืืง ืึธื ื ืขืืขื;
arp saddr ip 192.168.2.1 ืืึธืืืึทื ืง ืคึผืึทืงืืฅ 1 ืืืืขืก 46
}
} - ืฉืืืฆื ืคึฟืึทืจ ืืจืึทื ืกืคึผืขืจืึทื ื ืคืึธืจืืืขืจืืื ื ืจืืงืืืขืก ืืืจื ืึท ืคึผืจืึทืงืกื (ืืคึผืจืึธืงืกื). ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืจืืืขืจืขืงื ืงืึทืืืก ืฆื ืคึผืึธืจื 80 ืฆื ืคืจืืงืกื ืคึผืึธืจื 8080:
ืืืฉ ืืคึผ ืจืขื ืืืขื {
ืงืืื ื {
ืืืคึผ ืคืืืืขืจ ืคืึทืจืืฉืขืคึผืขื ืคึผืจืืจืึธืืืื ื ืืืืืขืจืงืืึทื -150; ืคึผืึธืืืืืง ืึธื ื ืขืืขื;
tcp dport 80 tproxy ืฆื: 8080
}
} - ืฉืืืฆื ืคึฟืึทืจ ืืึทืจืงืื ื ืกืึทืงืึทืฅ ืืื ืื ืคืืืืงืืื ืฆื ืืึทืงืืืขื ืื ืืึทืฉืืขืืืงื ืฆืืืื ืืืจื setsockopt () ืืื SO_MARK ืืึธืืข. ืืืฉื:
ืืึทืืืข ืื ืขื ืจืขื ืืืขื {
ืงืืื ื {
ืืืคึผ ืคืืืืขืจ ืคืึทืจืืฉืขืคึผืขื ืคึผืจืืจืึธืืืื ื ืืืืืขืจืงืืึทื -150; ืคึผืึธืืืืืง ืึธื ื ืขืืขื;
tcp dport 8080 ืืืจืง ืฉืืขืื ืืึธืืขื ืืืจืง
}
} - ืฉืืืฆื ืคึฟืึทืจ ืกืคึผืขืฆืืคืืฆืืจื ืืืืืขืจืงืืึทื ืืขืงืกื ื ืขืืขื ืคึฟืึทืจ ืงืืืื. ืืืฉื:
nft ืืืืื ืงืืื ืืคึผ ืจืขื ืืืขื ืจืื {ืืืคึผ ืคืืืืขืจ ืคืึทืจืืฉืขืคึผืขื ืคึผืจืืจืึธืืืื ื ืืืืืขืจืงืืึทื ืจืื; }
nft ืืืืื ืงืืื ืืคึผ ืจืขื ืืืขื ืคืืืืขืจ {ืืืคึผ ืคืืืืขืจ ืคืึทืจืืฉืขืคึผืขื ืคึผืจืืจืึธืืืื ื ืืืืืขืจืงืืึทื ืคืืืืขืจ; }
nft ืืืืื ืงืืื ืืคึผ ืจืขื ืืืขื ืคืืืืขืจ_ืืืืืขืจ {ืืืคึผ ืคืืืืขืจ ืคืึทืจืืฉืขืคึผืขื ืคึผืจืืจืึธืืืื ื ืืืืืขืจืงืืึทื ืคืืืืขืจ + 10; } - ืฉืืืฆื ืคึฟืึทืจ ืกืขืืื ืืงืก ืืึทืืก (ืกืขืงืืึทืจืง). ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืืขืคืื ืืจื ืื "sshtag" ืงืืืืื ืืื ืึท SELinux ืงืึธื ืืขืงืกื, ืืืจ ืงืขื ืขื ืืืืคื:
nft add secmark inet filter sshtag "system_u:object_r:ssh_server_packet_t:s0"
ืืื ืืขืืึธืื ื ืืฆื ืืขื ืคืืจืืข ืืื ืื ืึผืืืื:
nft add rule inet filter input tcp dport 22 meta secmark set "sshtag"
nft ืืืืื ืืึทืคึผืข ืื ืขื ืคืืืืขืจ ืกืขืงืืึทืคึผืื ื {ืืืคึผ inet_service: secmark; }
nft add element inet filter secmapping {22: "sshtag"}
nft ืืืืื ืืขืจืฉื ืื ืขื ืคืืืืขืจ ืึทืจืืึทื ืฉืจืืึทื ืืขืืึท ืกืขืงืืึทืจืง ืฉืืขืื tcp dport map @secmapping - ืคืืืืงืืื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืคึผืึธืจืฅ ืึทืกืืื ื ืฆื ืคึผืจืึธืืึธืงืึธืืก ืืื ืืขืงืกื ืคืึธืจืขื, ืืื ืืื ืืขื ืขื ืืืคืืื ื ืืื ืื /etc/services ืืขืงืข. ืืืฉื:
nft add rule xy tcp dport "ssh"
nft ืจืฉืืื ืึผืืืืืกืขื -ื
ืืืฉ ืจืขื ืืืขื {
ืงืืื ื {
...
tcp dport "ssh"
}
} - ืคืืืืงืืื ืฆื ืงืึธื ืืจืึธืืืจื ืืขื ืืืคึผ ืคืื ื ืขืฅ ืฆืืืื ื. ืืืฉื:
ืืืืื ืืขืจืฉื ืื ืขื ืจืื ืคึผืจืขืจืึธืืืื ื ืืขืืึท ืืืคืงืื ื "ืืืจืฃ" ืึธื ื ืขืืขื
- ืืืคึผืจืืืื ืฉืืืฆื ืคึฟืึทืจ ืืื ืึทืืืฉ ืึทืคึผืืืืืื ื ืื ืืื ืืึทืื ืคืื ืฉืืขืื ืืืจื ืืคืืจืืฉ ืกืคึผืขืฆืืคืืฆืืจื ืื "ืืื ืึทืืืฉ" ืคืึธื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืืขืจืืืึทื ืืืงื ืฉืืขืื "s" ืฆื ืืืืื ืื ืืงืืจ ืึทืืจืขืก ืืื ืืึทืฉืืขืืืง ืื ืคึผืึธืืืฆืืข ืืืื ืขืก ืืขื ืขื ืงืืื ืคึผืึทืงืืฅ ืคึฟืึทืจ 30 ืกืขืงืื ืืขืก:
ืืืืื ืืืฉ ืจืขื ืืืขื
ืืืื ืฉืืขืื ืงืกืก {ืืืคึผ ืืคึผืื4_ืึทืืืจ; ืืจืืืก 128; ืืืืืึทืื 30 ืก; ืคืืึทืืก ืืื ืึทืืืฉ; }
ืืืืื ืงืืื ืงืกื {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื 0; }
ืืืื ืืขืจืฉื xy ืืขืจืืืึทื ืืืงื @s {ip saddr} - ืคืืืืงืืื ืฆื ืฉืืขืื ืึท ืืึทืืื ืืขืจ ืืืืืึทืื ืฆืืฉืืึทื ื. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืฆื ืึธืืืืขืจืจืืื ืื ืคืขืืืงืืึทื ืืืืืึทืื ืคึฟืึทืจ ืคึผืึทืงืืฅ ืขืจืืืืืื ื ืืืืฃ ืคึผืึธืจื 8888, ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื:
ืืืฉ ืืคึผ ืคืืืืขืจ {
ct timeout aggressive-tcp {
ืคึผืจืึธืืึธืงืึธื tcp;
l3proto ip;
ืคึผืึธืืืืืง = {ืืขืืจืื ืืขื: 100, ื ืึธืขื ื_ืืืึทืื: 4, ื ืึธืขื ื: 4}
}
ืงืืื ืจืขืืืืืึทื {
...
tcp dport 8888 ct ืืืืืึทืื ืฉืืขืื "ืึทืืจืขืกืืื-ืืงืคึผ"
}
} - NAT ืฉืืืฆื ืคึฟืึทืจ ืื ืขื ืืฉืคึผืื:
ืืืฉ ืืื ืขื ื ืื {
...
ืืคึผ6 ืืึทืืืจ ืืขื::2::1 ืื ืึทื ืฆื ืืืื:2::99
} - ืืืคึผืจืืืื ืืืคึผืึธ ืืขืืช ืจืืคึผืึธืจืืื ื:
nft ืืืืื ืงืืื ืคืืืืขืจ ืคึผืจืืืืจื
ืืขืืช: ื ืื ืึทืืึท ืืขืงืข ืึธืืขืจ ืืืขืืืืืึทืืขืจ; ืืื ืืืจ ืืืื ืขื ืืืฉ "ืคืืืืขืจ" ืืื ืืฉืคึผืื ืืคึผ?
ืืืืื ืงืืื ืคืืืืขืจ ืคึผืจืืืืจื
^^^^^^^ - ืคืืืืงืืื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืฆืืืื ื ื ืขืืขื ืืื ืฉืืขืื:
ืฉืืขืื ืกืง {
ืืืคึผ inet_service. ifname
ืขืืขืืขื ืื = { "ืฉืฉ" . "ืขืื0" }
} - ืืขืจืืืึทื ืืืงื ืคืืึธืืืึทืืืข ืึผืืืื ืกืื ืืึทืงืก:
nft ืืืืื ืืืฉ ืจืขื ืืืขื
nft add flowtable x ft { ืคืึทืจืืฉืขืคึผืขื ืื ืืจืขืกืก ืืืืืขืจืงืืึทื 0; ืืขืืืืกืขืก = {ืขืื0, ืืืืึทื0}; }
...
nft add rule x forward ip protocol {tcp, udp} flow add @ft - ืืืคึผืจืืืื JSON ืฉืืืฆื.
ืืงืืจ: opennet.ru