Nftables: Unterschied zwischen den Versionen

Aktuelle Version vom 22. April 2025, 18:11 Uhr

@@ Zeile 1: / Zeile 1: @@
-*[[Nftabels Grundlagen]]
+[[Kategorie:Nftables]]
-*[[Nftables Filter]]
+* [[Nftabels Grundlagen]]
+* [[Grundlegendes zum Connection Tracking]]
-=Install=
+* [[nftables console]]
-*apt-get install nftables
+* [[iptables zu nftables]]
-=Create a basic IPv4 table=
+* [[nftables Masquerade]]
-*nft add table inet filter
+* [[nftables Host absichern]]
-=List that table=
+* [[nftables Netze absichern]]
-*nft list table inet filter
+* [[nftables misc]]
- table inet filter {
+* [[nftables Erweiterungen]]
- }
+* [[nftables ipsec]]
-=Create a chain for input,output,forward traffic IPv4=
+* [[nftables Anpassung]]
-*nft add chain inet filter input { type filter hook input priority 0\; }
+* [[nftables Netmap]]
-*nft add chain inet filter output { type filter hook output priority 0\; }
-*nft add chain inet filter forward { type filter hook forward priority 0\; }
-=Conntracking for input,output,forward=
-*nft add rule filter input ct state established,related counter accept
-*nft add rule filter output ct state established,related counter accept
-*nft add rule filter forward ct state established,related counter accept
-=loopback interface traffic is ok=
-*nft add rule filter input  iifname "lo" counter accept
-*nft add rule filter output  oifname "lo" counter accept
-=A rule to check that ssh,http,https input is fine (IPv4)=
-*nft add rule filter input tcp dport 22 counter accept
-*nft add rule filter input tcp dport 80 counter accept
-*nft add rule filter input tcp dport 443 counter accept
-=A rule to check that output is fine (IPv4)=
-*nft add rule filter output counter accept
-=A rule to check that some forward is fine (IPv4)=
-*nft add rule filter forward  iifname "ens19" oifname "ens18" tcp dport 22 counter accept
-*nft add rule filter forward  iifname "ens19" oifname "ens18" tcp dport 443 counter accept
-=Example Script=
-<pre>
-#!/usr/sbin/nft -f
-#variable declration
-define tcp_lan_input_ports = { 8472, 53 }
-define tcp_all_input_ports = { 80, 443 }
-define udp_lan_input_ports = { 53 }
-define tcp_for_input_ports = { 53 }
-define udp_for_input_ports = {  53 }
-# table declaration
-#
-add table filter
-add table nat
-flush table filter
-flush table nat
-table filter {
-        chain input {
-                type filter hook input priority 0; policy drop;
-                ct state established,related counter packets 97 bytes 6640 accept
-                iifname "lo" counter accept
-                iifname "ens19" tcp dport $tcp_lan_input_ports counter accept
-                tcp dport $tcp_all_input_ports  counter accept
-                udp dport $udp_lan_input_ports  counter accept
-                log prefix "nft-input "
-        }
-        chain output {
-                type filter hook output priority 0; policy drop;
-                ct state established,related counter accept
-                counter accept
-                log prefix "nft-output "
-        }
-        chain forward {
-                type filter hook forward priority 0; policy drop;
-                ct state established,related counter accept
-                iifname "ens19" oifname "ens19" counter accept
-                iifname "ens19" oifname "ens18" tcp dport $tcp_for_input_ports counter accept
-                iifname "ens19" oifname "ens18" udp dport $udp_for_input_ports counter accept
-                iifname "ens19" oifname "ens18" icmp type echo-request counter accept
-                log prefix "nft-forward "
-        }
-}
-table ip nat {
-      chain prerouting {
-                  type nat hook prerouting priority 0;
-     }
-      chain postrouting {
-                  type nat hook postrouting priority 0;
-                  ip saddr 10.83.33.0/24 oif ens18 snat 10.84.252.33
-      }
-}
-,1           Top
-</pre>
-=List that table=
-*nft list table inet filter
-=Flush rules in chain filter/input=
-*nft flush chain inet filter input
-=Delete the chain filter/input=
-*nft delete chain inet filter input
-=Delete the table filter=
-*nft delete table inet filter
-=Links=
-*https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
-*https://wiki.archlinux.org/index.php/nftables

Nftables: Unterschied zwischen den Versionen

Aktuelle Version vom 22. April 2025, 18:11 Uhr

Navigationsmenü

Suche