Admin: /* Определение таблицы IPv4 */

2025-12-30T08:05:34Z

Определение таблицы IPv4

Новая страница

== Базовая информация ==

{| class="wikitable"
|colspan="2"|type
|-
|filter||Supported by arp, bridge, ip, ip6 and inet table families
|-
|route||Mark packets (like mangle for the output hook, for other hooks use the type filter instead), supported by ip and ip6
|-
|nat||In order to perform Network Address Translation, supported by ip and ip6
|}

{| class="wikitable"
|colspan="2"|приоритет
|-
|NF_IP_PRI_CONNTRACK_DEFRAG||-400
|-
|NF_IP_PRI_RAW||-300
|-
|NF_IP_PRI_SELINUX_FIRST||-225
|-
|NF_IP_PRI_CONNTRACK||-200
|-
|NF_IP_PRI_MANGLE||-150
|-
|NF_IP_PRI_NAT_DST||-100
|-
|NF_IP_PRI_FILTER||0
|-
|NF_IP_PRI_SECURITY||50
|-
|NF_IP_PRI_NAT_SRC||100
|-
|-NF_IP_PRI_SELINUX_LAST||225
|-
|-NF_IP_PRI_CONNTRACK_HELPER||300
|}

https://people.netfilter.org/pablo/nf-hooks.png

== Определение таблицы IPv4 ==

flush ruleset

include "/etc/nftables/define.nft"

table ip tbl0 {
include "/etc/nftables/counters.nft"

include "/etc/nftables/adm30/set_saddr.nft"
include "/etc/nftables/adm30/set_saddr-daddr.nft"
include "/etc/nftables/set_dport.nft"
include "/etc/nftables/set_daddr.nft"
include "/etc/nftables/set_saddr.nft"

include "/etc/nftables/mangle_pre.nft"
include "/etc/nftables/mangle_post.nft"
include "/etc/nftables/mangle_out.nft"

include "/etc/nftables/nat_dst.nft"
include "/etc/nftables/nat_src.nft"

include "/etc/nftables/filter_fwd.nft"
include "/etc/nftables/filter_in.nft"
}

==== Инициализация базовых цепочек ====

chain mangle_pre {
type filter hook prerouting priority -150; policy accept;
}

chain mangle_post {
type filter hook postrouting priority -150; policy accept;
}

chain mangle_out {
type route hook output priority -150; policy accept;
}

chain nat_dst {
type nat hook prerouting priority -100; policy accept;
}

chain nat_src {
type nat hook postrouting priority 100; policy accept;
}

chain filter_fwd {
type filter hook forward priority 0; policy drop;
}

chain filter_in {
type filter hook input priority 0; policy drop;
}

chain filter_out {
type filter hook output priority filter; policy accept;
}

== Определения структур ==

==== Определение наборов портов ====

set dport_tcp_1c {
type inet_service
flags interval
elements = { 1540, 1541, 1560-1591 }
}

set dport_tcp_aspia {
type inet_service
elements = { 8060, 8070 }
}

set dport_tcp_http {
type inet_service
elements = { 80, 443 }
}

set dport_tcp_smtp {
type inet_service
elements = { 25, 465, 587 }
}

set dport_tcp_imap {
type inet_service
elements = { 143, 993 }
}

set dport_tcp_dc {
type inet_service
flags interval
elements = { 53, 88, 135, 139, 389, 445, 464, 636, 3268, 3269, 49152-49154 }
}

set dport_udp_dc {
type inet_service
elements = { 53, 88, 137, 389, 464 }
}

==== Определение IP-назначений ====

define daddr_host_br = 192.168.11.130 //локальный адрес bridge-интерфейса сервера

define daddr_host_tun = 192.168.11.161 //локальный адрес tun-интерфейса сервера

define daddr_1c = 192.168.11.133

==== Определение наборов IP-источников ====

Набор [https://adm30.ru/fls/conf/nftables/set_saddr.nft.txt set_saddr.nft] из пакета [[Репозиторий пакетов:_nftables-rules-adm30|nftables-rules-adm30]]

set saddr_ovpn_admin {
type ipv4_addr
elements = { 192.168.2.10, 192.168.2.11 }
}

set saddr_ovpn_to_1c {
type ipv4_addr
elements = { 192.168.11.164 }
}

set saddr_to_usbipd {
type ipv4_addr
flags interval
elements = { 192.168.11.128/27, 192.168.11.160/28, 18.6.19.89 }
}

==== Определение наборов двунаправленных IP ====

Набор [https://adm30.ru/fls/conf/nftables/set_saddr-daddr.nft.txt set_saddr-daddr.nft] из пакета [[Репозиторий пакетов:_nftables-rules-adm30|nftables-rules-adm30]]

==== Определение счетчиков ====

counter cnt_smtp {
}

counter cnt_http {
comment "count both http and https packets"
}

== Примеры ==

filter

ct state established,related accept

ip saddr @saddr-daddr_local udp dport { 53, 123 } accept

ip saddr @saddr-daddr_local ip protocol icmp accept
icmp type echo-request accept

ip saddr @saddr_x ip daddr @daddr_x tcp dport @dport_tcp_x accept

ip saddr 192.168.11.111 ether saddr 50:50:00:30:C0:60 accept

ip saddr @saddr-daddr_local tcp dport 22 ct state new limit rate 2/hour burst 2 packets counter accept
ip daddr 172.16.0.55 tcp dport @dport_tcp_http ct state new limit rate 30/second burst 30 packets counter accept

ip daddr 192.168.11.111 tcp dport @dport_tcp_1c jump filter-in_dport_tcp_1c

tcp dport { 80, 443 } counter name cnt_http accept

tcp dport 22 ct state new accept

udp dport 1194 accept

iif{,name} "lo" accept

reject with icmp type admin-prohibited
reject with icmp type host-prohibited
reject with icmp type host-unreachable
reject with icmp type net-prohibited
reject with icmp type net-unreachable
reject with icmp type port-unreachable (default)
reject with icmp type prot-unreachable

nat

ip daddr $daddr_host_tun tcp dport @dport_tcp_1c dnat to $daddr_1c

ip daddr 195.82.146.120/30 tcp dport 80 dnat to 163.172.167.207:3128

ip daddr 192.168.100.0/24 snat to 192.168.100.1

mangle

ip saddr 192.168.11.192/27 ip protocol tcp ct state new ct mark 0x0 jump pre1_mark_ovpn
ip saddr 192.168.11.192/27 ct mark set 0x1
mark 0x1 counter meta priority set 1:1

Firewall: nftables - История изменений

Admin: /* Определение таблицы IPv4 */