====== Управление nftables ======

===== Полезные ресурсы =====

  * [[https://wiki.archlinux.org/title/Nftables_(%D0%A0%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9)|nftables (Русский)]]

===== Установка =====
<code bash>apt update && apt install nftables -y</code>

===== Файл конфигурации =====
<code bash>nano /etc/nftables.conf</code>

===== Просмотр правил и цепочек =====
<code bash>nft list ruleset</code>

===== Добавление правил =====
Данное правило добавляется в таблицу с именем table1 в цепочку chain_input и отбрасывает пакеты с ip-адресом источника отправления 8.8.8.8.
<code bash>nft add rule inet table1 chain_input ip saddr 8.8.8.8 drop</code>

===== Удаление правила =====
<code bash>nft delete rule inet table1 chain_input handle 3</code>

===== Пример нормально закрытого firewall`a =====
<code bash>#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;
                policy drop;

                iif lo accept comment "Accept any localhost traffic";
                ct state invalid drop comment "Drop all invalide connections";
                ct state established,related accept comment "Accept traffic originated from us";
                icmp type echo-request accept;

                tcp dport 2992 accept comment "Accept SSH on port 2992";
                tcp dport 80 accept comment "Accept HTTP on port 80";
                tcp dport 443 accept comment "Accept HTTPS on port 443";
        }
        chain forward {
                type filter hook forward priority 0;
                policy drop;
        }
        chain output {
                type filter hook output priority 0;
                policy accept;
        }
}

table ip6 ipv6 {
        chain input {
                type filter hook input priority 0;
                policy drop;
        }
        chain forward {
                type filter hook forward priority 0;
                policy drop;
        }
        chain output {
                type filter hook output priority 0;
                policy drop;
        }
}

</code>

===== Доступ к портам только с определенных IP =====
<code bash>#!/usr/sbin/nft -f

flush ruleset

table inet filter {
        chain input {
                type filter hook input priority 0;
                policy drop;

                iif lo accept comment "Accept any localhost traffic";
                ct state invalid drop comment "Drop all invalide connections";
                ct state established,related accept comment "Accept traffic originated from us";

                ip protocol icmp icmp type echo-request limit rate over 10/second burst 4 packets drop comment "Deny ping flood";
                icmp type echo-request accept;

                tcp dport 80 jump ACCEPT_ADDR comment "Accept HTTP";
                tcp dport 443 jump ACCEPT_ADDR comment "Accept HTTPS";
                tcp dport 2992 jump ACCEPT_ADDR comment "Accept SSH on port 2992";

        }
        chain forward {
                type filter hook forward priority 0;
                policy drop;
        }
        chain output {
                type filter hook output priority 0;
                policy accept;
        }
        chain ACCEPT_ADDR {
                ip saddr 95.165.25.210/32 accept; # Home
                ip saddr 217.10.33.88/32 accept;  # Parents
        }
}

table ip6 ipv6 {
        chain input {
                type filter hook input priority 0;
                policy drop;
        }
        chain forward {
                type filter hook forward priority 0;
                policy drop;
        }
        chain output {
                type filter hook output priority 0;
                policy drop;
        }
}

</code>