Firewall: nftables

Базовая информация

type
filter	Supported by arp, bridge, ip, ip6 and inet table families
route	Mark packets (like mangle for the output hook, for other hooks use the type filter instead), supported by ip and ip6
nat	In order to perform Network Address Translation, supported by ip and ip6

приоритет
NF_IP_PRI_CONNTRACK_DEFRAG	-400
NF_IP_PRI_RAW	-300
NF_IP_PRI_SELINUX_FIRST	-225
NF_IP_PRI_CONNTRACK	-200
NF_IP_PRI_MANGLE	-150
NF_IP_PRI_NAT_DST	-100
NF_IP_PRI_FILTER	0
NF_IP_PRI_SECURITY	50
NF_IP_PRI_NAT_SRC	100

Определение таблицы IPv4

flush ruleset

include "/etc/nftables/define.nft"

table ip tbl0 {
	include "/etc/nftables/counters.nft"

	include "/etc/nftables/adm30/set_saddr.nft"
	include "/etc/nftables/adm30/set_saddr-daddr.nft"
	include "/etc/nftables/set_dport.nft"
	include "/etc/nftables/set_daddr.nft"
	include "/etc/nftables/set_saddr.nft"

	include "/etc/nftables/mangle_pre.nft"
	include "/etc/nftables/mangle_post.nft"
	include "/etc/nftables/mangle_out.nft"

	include "/etc/nftables/nat_dst.nft"
	include "/etc/nftables/nat_src.nft"

	include "/etc/nftables/filter_fwd.nft"
	include "/etc/nftables/filter_in.nft"
}

Инициализация базовых цепочек

chain mangle_pre {
	type filter hook prerouting priority -150; policy accept;
}

chain mangle_post {
	type filter hook postrouting priority -150; policy accept;
}

chain mangle_out {
	type route hook output priority -150; policy accept;
}

chain nat_dst {
	type nat hook prerouting priority -100; policy accept;
}

chain nat_src {
	type nat hook postrouting priority 100; policy accept;
}

chain filter_fwd {
	type filter hook forward priority 0; policy drop;
}

chain filter_in {
	type filter hook input priority 0; policy drop;
}

chain filter_out {
	type filter hook output priority filter; policy accept;
}

Определения структур

Определение наборов портов

set dport_tcp_1c {
	type inet_service
	flags interval
	elements = { 1540, 1541, 1560-1591 }
}

set dport_tcp_aspia {
	type inet_service
	elements = { 8060, 8070 }
}

set dport_tcp_http {
	type inet_service
	elements = { 80, 443 }
}

set dport_tcp_smtp {
	type inet_service
	elements = { 25, 465, 587 }
}

set dport_tcp_imap {
	type inet_service
	elements = { 143, 993 }
}

set dport_tcp_dc {
	type inet_service
	flags interval
	elements = { 53, 88, 135, 139, 389, 445, 464, 636, 3268, 3269, 49152-49154 }
}

set dport_udp_dc {
	type inet_service
	elements = { 53, 88, 137, 389, 464 }
}

Определение IP-назначений

define daddr_host_br = 192.168.11.130 //локальный адрес bridge-интерфейса сервера

define daddr_host_tun = 192.168.11.161 //локальный адрес tun-интерфейса сервера

define daddr_1c = 192.168.11.133

Определение наборов IP-источников

Набор set_saddr.nft из пакета nftables-rules-adm30

set saddr_ovpn_admin {
	type ipv4_addr
	elements = { 192.168.2.10, 192.168.2.11 }
}

set saddr_ovpn_to_1c {
	type ipv4_addr
	elements = { 192.168.11.164 }
}

set saddr_to_usbipd {
	type ipv4_addr
	flags interval
	elements = { 192.168.11.128/27, 192.168.11.160/28, 18.6.19.89 }
}

Определение наборов двунаправленных IP

Набор set_saddr-daddr.nft из пакета nftables-rules-adm30

Определение счетчиков

counter cnt_smtp {
}

counter cnt_http {
	comment "count both http and https packets"
}

Примеры

filter

ct state established,related accept

ip saddr @saddr-daddr_local udp dport { 53, 123 } accept

ip saddr @saddr-daddr_local ip protocol icmp accept
icmp type echo-request accept

ip saddr @saddr_x ip daddr @daddr_x tcp dport @dport_tcp_x accept

ip saddr 192.168.11.111 ether saddr 50:50:00:30:C0:60 accept

ip saddr @saddr-daddr_local tcp dport 22 ct state new limit rate 2/hour burst 2 packets counter accept
ip daddr 172.16.0.55 tcp dport @dport_tcp_http ct state new limit rate 30/second burst 30 packets counter accept

ip daddr 192.168.11.111 tcp dport @dport_tcp_1c jump filter-in_dport_tcp_1c

tcp dport { 80, 443 } counter name cnt_http accept

tcp dport 22 ct state new accept

udp dport 1194 accept

iif{,name} "lo" accept

reject with icmp type admin-prohibited
reject with icmp type host-prohibited
reject with icmp type host-unreachable
reject with icmp type net-prohibited
reject with icmp type net-unreachable
reject with icmp type port-unreachable (default)
reject with icmp type prot-unreachable

nat

ip daddr $daddr_host_tun tcp dport @dport_tcp_1c dnat to $daddr_1c

ip daddr 195.82.146.120/30 tcp dport 80 dnat to 163.172.167.207:3128

ip daddr 192.168.100.0/24 snat to 192.168.100.1

mangle

ip saddr 192.168.11.192/27 ip protocol tcp ct state new ct mark 0x0 jump pre1_mark_ovpn
ip saddr 192.168.11.192/27 ct mark set 0x1
mark 0x1 counter meta priority set 1:1