ืื ืืขืืืื ื ืคืื ืคึผืึทืงืึทื ืคืืืืขืจ ื ืคืืึทืืืขืก 1.0.0 ืืื ืืจืืืก, ืืื ืึทืคืืืื ื ืคึผืึทืงืึทื ืคึฟืืืืจืืจืื ื ืื ืืขืจืคืืืกืื ืคึฟืึทืจ IPv4, IPv6, ARP ืืื ื ืขืฅ ืืจืืงื (ืึทืืืขื ืฆื ืคืึทืจืืืึทืื ืืคึผืืึทืืืขืก, ืืคึผ6ืืึทืืืข, ืึทืจืคึผืืึทืืืขืก ืืื ืขืืืึทืืืขืก). ืื ืขื ืืขืจืื ืืขื ืืืึธืก ืืขื ืขื ืคืืจืืื ืื ืคึฟืึทืจ ืื ืืขืืืื ื ืคืื nftables 1.0.0 ืฆื ืึทืจืืขืื ืืขื ืขื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืื Linux 5.13 ืงืขืจื. ื ืืึทืืืึทืืืง ืขื ืืขืจืื ื ืืื ืื ืืืขืจืกืืข ื ืืืขืจ ืืื ื ืืฉื ืคืืจืืื ืื ืืื ืงืืื ืคืื ืืึทืืขื ืืึทื ืขื ืืขืจืื ืืขื, ืึธืืขืจ ืืื ืืืืื ืึท ืงืึทื ืกืึทืงืืืึทื ืก ืคืื ืื ืงืึธื ืกืืกืืขื ื ืงืึทื ืืื ืืืืืฉืึทื ืคืื ื ืึทืืืขืจืื ื ืืื ืืขืฆืืืึทื ื ืึธืืืืืฉืึทื (ืื ืคืจืืขืจืืืงืข ืืขืืืื ื ืืื ืืขืืืขื 0.9.9).
ืื nftables ืคึผืขืงื ืืืื ืคึผืึทืงืึทื ืคืืืืขืจ ืงืึทืืคึผืึธืื ืึทื ืฅ ืืืึธืก ืืืืคื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ืืฉืขืช ืื ืงืขืจื-ืืืจืื ืึทืจืืขื ืืื ืฆืืืขืฉืืขืื ืืืจื ืื nf_tables ืกืึทืืกืืกืืึทื, ืืืึธืก ืืื ืืขืืืขื ืืืื ืคืื ืื ืืื ืืงืก ืงืขืจื ืืื ื ืืขืืืื ื 3.13. ืืขืจ ืงืขืจื ืืืจืื ืืื ืืืืื ืึท ืืืฉืึทื ืขืจืืง ืคึผืจืึธืืึธืงืึธื-ืคืจืืึท ืฆืืืื ื ืืืึธืก ืืื ืืงืขืจืืืง ืคืึทื ืืงืฉืึทื ื ืคึฟืึทืจ ืืงืกืืจืึทืงืืื ื ืืึทืื ืคืื ืคึผืึทืงืืฅ, ืคึผืขืจืคืึธืจืืื ื ืืึทืื ืึทืคึผืขืจืืืฉืึทื ื ืืื ืืืืคื ืงืึธื ืืจืึธื.
ืื ืคึฟืืืืจืืจืื ื ืึผืืืื ืืื ืคึผืจืึธืืึธืงืึธื-ืกืคึผืขืฆืืคืืฉ ืืึทื ืืืขืจืก ืืขื ืขื ืงืึทืืคึผืืืื ืืื ืืืืขืงืึธืืข ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ, ื ืึธื ืืืึธืก ืืขื ืืืืืขืงืึธื ืืื ืืึธืืืื ืืื ืื ืงืขืจื ื ืืฆื ืื ื ืขืืืื ืง ืฆืืืื ื ืืื ืขืงืกืึทืงืืืืึทื ืืื ืื ืงืขืจื ืืื ืึท ืกืคึผืขืฆืืขื ืืืืจืืืึทื ืืึทืฉืื ืจืขืืึทื ืืกืึทื ื ืคืื BPF (Berkeley Packet Filters). ืืขืจ ืฆืืืึทื ื ืึทืืึทืื ืืืจ ืฆื ืืืืืืืืง ืจืขืืืฆืืจื ืื ืืจืืืก ืคืื ืื ืคึฟืืืืจืืจืื ื ืงืึธื ืคืืืกื ืืืง ืืืืฃ ืื ืงืขืจื ืืืจืื ืืื ืืึทื ืึทืืข ืื ืคืึทื ืืงืฉืึทื ื ืคืื ืคึผืึทืจืกืื ื ืึผืืืื ืืื ืืึธืืืง ืคึฟืึทืจ ืืจืืขืื ืืื ืคึผืจืึธืืึธืงืึธืืก ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ.
ืืืืคึผื ืืืืืฉืื:
- ืกืืคึผืคึผืึธืจื ืคึฟืึทืจ ืื "*" ืืึทืกืงืข ืขืืขืืขื ื ืืื ืฆืืืขืืขืื ืฆื ืฉืืขืื ืจืฉืืืืช, ืืืึธืก ืืื ืืจืืืขืจื ืคึฟืึทืจ ืงืืื ืคึผืึทืงืึทืืืฉืึทื ืืืึธืก ืืึธื ื ืื ืคืึทืื ืืื ืืขืจ ืื ืืขืจืข ืขืืขืืขื ืื ืืืคืืื ื ืืื ืืขื ืืึทื ื. ืืืฉ ืจืขื ืืืขื {ืืึทืคึผืข ืืืึธืงืืืกื {ืืืคึผ ืืคึผืื4_ืึทืืืจ: ืืืขืจืืืงื ืคืืึทืืก ืืขืืึทืืขื ืขืืขืืขื ืื = {192.168.0.0/16: ืึธื ื ืขืืขื, 10.0.0.0/8: ืึธื ื ืขืืขื, *: ืคืึทืื}} ืงืืื ื {ืืืคึผ ืคืืืืขืจ ืคืึทืจืืฉืขืคึผืขื ืคึผืจืืจืึธืืืื ื ืืืืืขืจืงืืึทื 0; ืคึผืึธืืืืืง ืึธื ื ืขืืขื; ip saddr vmap @ืืืึธืงืืืกื } }
- ืขืก ืืื ืืขืืืขื ืฆื ืืขืคืื ืืจื ืืืขืจืืึทืืึทืื ืคึฟืื ืื ืืึทืคึฟืขืื ืฉืืจื ื ืืฆื ืื "--ืืขืคืื ืืจื" ืึธืคึผืฆืืข. # ืงืึทืฅ ืืขืกื.ื ืคื ืืืฉ ื ืขืืืขืื ืจืขื ืืืขื { ืงืืื ื {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืื ืืจืขืกืก ืืขืืืืกืขืก = $ ืืขืื ืืืืืขืจืงืืึทื 0; ืคืืืืกื ืคืึทืื; } } # nft โ ืืขืคืื ืืจื ืืขืื = "{ eth0, eth1 }" -f test.nft
- ืืื ืืึทืคึผืข ืจืฉืืืืช, ืื ื ืืฆื ืคืื ืงืขืกืืืืขืจืืืง (ืกืืืืืคืึทื) ืืืืกืืจืืงื ืืื ืขืจืืืืื: ืืืฉ ืื ืขื ืคืืืืขืจ { ืืึทืคึผืข ืคึผืึธืจืืืึทืคึผ {ืืืคึผ inet_service: ืืืขืจืืืงื ืืึธืืืึทื ืง ืขืืขืืขื ืื = {22 ืืึธืืืึทื ืง ืคึผืึทืงืืฅ 0 ืืืืขืก 0: ืฉืคึผืจืื ืืขื ssh_input, * ืืึธืืืึทื ืง ืคึผืึทืงืืฅ 0 ืืืืขืก 0: ืงืึทืคึผ }} ืงืืื ssh_input {} ืงืืื wan_input {tcp dport vmap @portmap} ืงืืื ืคึผืจืืจืึธืืืื ื {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืคึผืจืขืจืึธืืืื ื ืืืืืขืจืงืืึทื ืจืื; ืคึผืึธืืืืืง ืึธื ื ืขืืขื; iif vmap {"ืืึธ": ืฉืคึผืจืื ืืขื wan_input}}}
- ืฆืืืขืืืืื "ืจืฉืืื ืืืงืก" ืืึทืคึฟืขื ืฆื ืืืืึทืื ืึท ืจืฉืืื ืคืื ืืึทื ืืืขืจืก ืคึฟืึทืจ ืึท ืืขืืขืื ืคึผืึทืงืึทื ืืฉืคึผืื: # nft ืจืฉืืื ืืืงืก ืืคึผ ืืืื eth0 ืืฉืคึผืื ืืคึผ {ืืึธืงื ืื ืืจืขืกืก {+0000000010 ืงืืื ื ืขืืืขืื ืงืกื [ื ืค_ืืึทืืืขืก] +0000000300 ืงืืื ืื ืขื ืืื [ื ืค_ืืึทืืืขืก] } {-0000000100/0000000300 ืืฉืึทืื IP [NF_TIBALS] +0000000225 ืงืืื ืื ืขื MZ [nf_tables_IPV4_TONUX_IPV0000000000_TONUX_IPV0000000225_TONUX_IPOTING {+4 0000000225 ืกืขืืื ืืงืก_ืืคึผ V4_Postroute}}}
- ืจืื ืืืึทืงืก ืืึธืื ืืืฉืืึทืฉ, ืกืืืืึทืฉ ืืื ื ืืืืขื ืืืืกืืจืืงื ืฆื ืืืื ืงืึทืืืืื ื ืฆื ืคืึทืจืฉืคึผืจืืืื ืคึผืึทืงืืฅ ืฆื ืงืืื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ. โฆ ืจืื ืฆื ืกืืืืึทืฉ ืืึธื 65536 โฆ ืจืื ืคืืึทืืก ืืืืคึผืึทืก ืฆื ื ืืืืขื ืื ืง ืืึธื 65536 โฆ ืจืื ืฆื ืืืฉืืึทืฉ ืึธืืฃ . ืืขืืึท ืืึทืจืง ืืึธื 32 "ืจืื" ืงืขื ืขื ืืืื ืืืื ืงืึทืืืืื ื ืืื ืืึทืคึผืข ืจืฉืืืืช ืฆื ืกืขืืขืงืืืจื ืึท ืจืื ืืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืืืืจื ืืืืฃ ืึทืจืืืืจืึทืจืืฉ ืฉืืืกืืขื. ... ืจืื ืคืืึทืืก ืืืืคึผืึทืก ืฆื ืื ื ืึธืืขื ืืึทืคึผืข {"eth0": 0, "ppp0": 2, "eth1": 2}
- ืขืก ืืื ืืขืืืขื ืฆื ืืงืกืคึผืึทื ื ืืืขืจืืึทืืึทืื ืืืึธืก ืึทืจืืึทื ื ืขืืขื ืึท ืกืืื ืจืฉืืื ืืื ืขืืืขืืข ืืึทืคึผืก. ืืขืคืื ืืจื ืื ืืขืจืคืืืกืื = {ืขืื0, ืขืื1} ืืืฉ ืืคึผ ืจืขื ืืืขื {ืงืืื ื {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื 0; ืคึผืึธืืืืืง ืึธื ื ืขืืขื; iifname vmap {ืืึธ: ืึธื ื ืขืืขื, $ ืื ืืขืจืคืืืกืื: ืคืึทืื}}} # nft -f x.nft # nft ืจืฉืืื ืึผืืืื ืกืขื ืืืฉ ืืคึผ ืจืขื ืืืขื { ืงืืื ื {ืืืคึผ ืคืืืืขืจ ืงืจืืง ืึทืจืืึทื ืฉืจืืึทื ืืืืืขืจืงืืึทื 0; ืคึผืึธืืืืืง ืึธื ื ืขืืขื; iifname vmap {"ืืึธ": ืึธื ื ืขืืขื, "ืขืื0": ืงืึทืคึผ, "ืขืื1": ืงืึทืคึผ}}}
- ืงืึทืืืืื ืื ื ืืืืึทืคึผืก (ืืืขืจืืืงื ืืึทืคึผืข) ืืื ืื ืืขืจืืืึทืื ืืื ืขืจืืืืื: # nft add rule xy tcp dport . ip saddr vmap {1025-65535. 192.168.10.2: ืึธื ื ืขืืขื }
- ืกืืืคึผืืืคืืขื ืกืื ืืึทืงืก ืคึฟืึทืจ NAT ืืึทืคึผืื ืื. ืืขืจืืืืื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืึทืืจืขืก ืจืืื ืืืฉืึทื: ... snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } ืึธืืขืจ ืืงืกืคึผืืืกืึทื ืืคึผ ืืืขื ืื ืืื ืคึผืึธืจืฅ: ... ืื ืึทื ืฆื ืืคึผ ืกืึทืืจ ืืึทืคึผืข {10.141.11.4: 192.168.2.3. . 80 } ืึธืืขืจ ืงืึทืืืึทื ืืืฉืึทื ื ืคืื IP ืจืืื ืืืฉืึทื ืืื ืคึผืึธืจืฅ: ... dnat to ip saddr . tcp dport ืืึทืคึผืข {192.168.1.2. 80: 10.141.10.2-10.141.10.5. 8888-8999 }
ืืงืืจ: opennet.ru