{"id":88403,"date":"2020-02-13T16:11:39","date_gmt":"2020-02-13T08:11:39","guid":{"rendered":"http:\/\/4563.org\/?p=88403"},"modified":"2020-02-13T16:11:39","modified_gmt":"2020-02-13T08:11:39","slug":"%e8%af%b7%e9%97%ae%e6%80%8e%e4%b9%88%e7%94%a8-nftables-%e9%99%90%e5%88%b6%e9%80%9f%e7%8e%87%ef%bc%9f%e4%b8%ba%e4%bb%80%e4%b9%88%e6%88%91%e6%b7%bb%e5%8a%a0%e7%9a%84%e8%a7%84%e5%88%99%e6%80%bb%e6%98%af","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=88403","title":{"rendered":"\u8bf7\u95ee\u600e\u4e48\u7528 nftables \u9650\u5236\u901f\u7387\uff1f\u4e3a\u4ec0\u4e48\u6211\u6dfb\u52a0\u7684\u89c4\u5219\u603b\u662f\u4e0d\u7b26\u5408\u6211\u7684\u9884\u671f\uff1f"},"content":{"rendered":"<div>\n<div>\n<div>\n<h1>                  \u8bf7\u95ee\u600e\u4e48\u7528 nftables \u9650\u5236\u901f\u7387\uff1f\u4e3a\u4ec0\u4e48\u6211\u6dfb\u52a0\u7684\u89c4\u5219\u603b\u662f\u4e0d\u7b26\u5408\u6211\u7684\u9884\u671f\uff1f               <\/h1>\n<p> <\/p>\n<div>\n<div> <span>\u8cc7\u6df1\u5927\u4f6c : skinny <\/span>  <span><i><\/i> 24<\/span> <\/div>\n<div> <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div isfirst=\"1\"> <\/p>\n<pre><code>\u64cd\u4f5c\u7cfb\u7edf\uff1adebian buster (stable) \u8fd0\u884c\u73af\u5883\uff1avirtualbox \u865a\u62df\u673a \u7f51\u7edc\u8bbe\u7f6e\uff1abridge nftables \u7248\u672c\uff1a0.9.0 <\/code><\/pre>\n<p>ping \u547d\u4ee4\uff1apsping64 -t -i 0 192.168.1.177<\/p>\n<p>\u6bd4\u5982\uff0c\u6211\u60f3\u9650\u5236\u6bcf\u79d2\u53ea\u5904\u7406\u4e00\u4e2a icmp echo-request\uff0c\u89c4\u5219\u914d\u7f6e\u6587\u4ef6\u5982\u4e0b\uff1a<\/p>\n<pre><code>#!\/usr\/sbin\/nft -f flush ruleset  define ICMP_TYPES = {     destination-unreachable,     time-exceeded,     parameter-problem,     router-solicitation,     router-advertisement }  define ICMPV6_TYPES = {     destination-unreachable,     packet-too-big,     time-exceeded,     parameter-problem,     mld-listener-query,     mld-listener-report,     mld-listener-done,     mld-listener-reduction,     nd-router-solicit,     nd-router-advert,     nd-neighbor-solicit,     nd-neighbor-advert,     ind-neighbor-solicit,     ind-neighbor-advert,     mld2-listener-report }   table inet filter {     chain input {         type filter hook input priority 0; policy drop;          iif lo accept         ct state invalid drop         ct state { established, related } accept          icmp type echo-request limit rate 1\/second accept          icmpv6 icmpv6 type $ICMPV6_TYPES accept         icmp icmp type $ICMP_TYPES accept          ip protocol igmp accept          tcp dport { ssh } accept     }      chain forward {         type filter hook forward priority 0; policy drop;     }      chain output {         type filter hook output priority 0; policy accept;     } }  <\/code><\/pre>\n<p>\u4f7f\u7528 fast ping \u5de5\u5177\u6d4b\u8bd5\u65f6\uff0c\u5e73\u5747\u95f4\u9694 0.68ms \u5de6\u53f3\uff0c\u4e14 0% loss \u3002 \u6211\u5c1d\u8bd5\u8fc7\u6dfb\u52a0\u4e0b\u9762\u7684\u89c4\u5219\u8bd5\u56fe\u629b\u5f03\u8d85\u8fc7\u9650\u5236\u7684\uff0c\u7ed3\u679c\u6ca1\u6709\u53d8\u5316\u3002<\/p>\n<pre><code>icmp type echo-request limit rate over 1\/second drop <\/code><\/pre>\n<p>\u8fd8\u5c1d\u8bd5\u8fc7 burst &lt;num&gt; packets \u8bed\u53e5\uff0c\u4e5f\u6ca1\u6709\u7528\u3002<\/p>\n<\/p><\/div>\n<div> <b>\u5927\u4f6c\u6709\u8a71\u8aaa<\/b> (<span>0<\/span>)        <\/div>\n<div> <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<ul>\n<li>\n","protected":false},"excerpt":{"rendered":"<p>\u8bf7\u95ee\u600e\u4e48\u7528 nftables \u9650\u5236&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/88403"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=88403"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/88403\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=88403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=88403"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=88403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}