Centos 9 实战nftables

现有Centos8之后版本有三款防火墙分别是 iptables nftables firewalld 简单说一下区别深入研究请自行查询文档。

iptables 是传统且功能强大的工具，适用于精细化的规则管理和配置，在Cenos8之后逐步淘汰当然现在也是能用偶尔在升级软件时报兼容性错误
nftables 是 iptables 的继任者，提供更高效的性能和更简洁的配置方式，适合现代 Linux 系统。
firewalld 是一个前端管理工具，基于区域和服务的配置方式，使防火墙管理更加简单，使用 iptables 或 nftables 作为底层引擎。

停止iptables firewalld并禁止开机启动回显iptables和firewalld为disabled

sudo systemctl stop iptables
sudo systemctl disable iptables
sudo systemctl is-enabled iptables
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo systemctl is-enabled firewalld

国内没发现有人写关于这块实战都是长篇大论的哎以Centos9为例实战禁止国外IP访问默认安装编辑配置文件该方案去年已运用于 e.erw.cc

mv /etc/sysconfig/nftables.conf /etc/sysconfig/nftables.conf.bak
vi /etc/sysconfig/nftables.conf

把下面配置复制进去

table ip filter {
    chain input {
        type filter hook input priority 0; policy accept;

        # Local loop
        iifname "lo" accept

        # Allow SSH
        tcp dport 22 accept

        # Drop ICMP echo requests (ping)
        icmp type echo-request drop

        # Block specific source IP ranges for HTTP/HTTPS
        ip saddr 1.1.1.1/24 tcp dport {80, 443} drop

        # Drop IPs from a malicious IP set
        ip saddr @ips tcp dport {80, 443} accept

        # Default drop for HTTP/HTTPS, only applies if no earlier rule matched
        tcp dport {80, 443} drop
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

这配置也没啥好说的，看得懂的朋友自然知道怎么搭配和修改注：@ips是IP集合用于允许国内IP

访问Github获取国内IP段下次写个脚本从apnic获取最新

https://github.com/17mon/china_ip_list

新建ips 用于存储国内IP段（cidr)

vi /etc/sysconfig/ips

新建ip集合脚本

vi /etc/sysconfig/rule_set.sh

脚本如下

#!/bin/bash

nft add table ip filter 2>/dev/null
nft add set ip filter ips { type ipv4_addr\; flags interval\; } 2>/dev/null

if [ ! -f /etc/sysconfig/ips ]; then
  echo "IP file /etc/sysconfig/ips not found"
  exit 1
fi

add_ips() {
    local set_name=$1
    local ip_list=$2
    if [[ -z "$ip_list" ]]; then
        return
    fi

    local max_ips=1000 # 分批每次最多添加1000行
    local ip_count=0
    local batch=""

    for ip in $(echo "$ip_list" | tr ',' '\n'); do
        batch+="$ip,"
        ((ip_count++))
        if ((ip_count == max_ips)); then
            batch="${batch%,}"
            echo "Adding IPs to '$set_name': $batch"
            nft add element ip filter "$set_name" { $batch }
            batch=""
            ip_count=0
        fi
    done
    if [[ -n "$batch" ]]; then
        batch="${batch%,}"
        echo "Adding IPs to '$set_name': $batch"
        nft add element ip filter "$set_name" { $batch }
    fi
}

ips=""
while read -r ip; do
    if [[ -n "$ip" ]]; then
        ips+="$ip,"
    fi
done < /etc/sysconfig/ips

add_ips "ips" "$ips"

增加执行权限执行脚本

chmod +x /etc/sysconfig/rule_set.sh
sudo bash /etc/sysconfig/rule_set.sh

加载 nftables 规则

sudo nft -f /etc/sysconfig/nftables.conf

查看规则是否生效

sudo nft list ruleset

保存规则

sudo nft list ruleset > /etc/sysconfig/nftables.conf

查看集合规则

sudo nft list set ip filter ips

开机启动

sudo systemctl enable nftables
sudo systemctl start nftables
sudo systemctl status nftables

效果

[root@VM-20-2-centos ~]# systemctl status nftables
● nftables.service - Netfilter Tables
     Loaded: loaded (/usr/lib/systemd/system/nftables.service; enabled; preset: disabled)
     Active: active (exited) since Wed 2025-01-08 01:49:52 CST; 12h ago
       Docs: man:nft(8)
    Process: 615 ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf (code=exited, status=0/SUCCESS)
   Main PID: 615 (code=exited, status=0/SUCCESS)
        CPU: 67ms

1月 08 01:49:52 VM-20-2-centos systemd[1]: Starting Netfilter Tables...
1月 08 01:49:52 VM-20-2-centos systemd[1]: Finished Netfilter Tables.

查看配置因有IP集合配置太多就不全部放出来了

                             223.223.192.0/20, 223.240.0.0/13,
                             223.248.0.0/14, 223.252.128.0/19,
                             223.252.192.0/18, 223.254.0.0/16,
                             223.255.0.0/17, 223.255.236.0/22,
                             223.255.252.0/23 }
        }

        set eip {
                type ipv4_addr
                flags interval
        }

        chain input {
                type filter hook input priority filter; policy accept;
                iifname "lo" accept
                tcp dport 22 accept
                icmp type echo-request drop
                ip saddr 120.208.185.0/24 tcp dport { 80, 443 } drop
                ip saddr @ips tcp dport { 80, 443 } accept
                tcp dport { 80, 443 } drop
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}

下面是一些基础命令

清空现有nftables规则

sudo nft flush ruleset

添加新的 IP 到集合

sudo nft add element ip filter ips { 192.168.1.0/24 }

从集合中删除 IP

sudo nft delete element ip filter ips { 192.168.1.0/24 }

删除 eip 集合规则

sudo sed -i '/ip saddr @eip tcp dport { 80, 443 } drop/d' /etc/sysconfig/nftables.conf

删除整个集合规则

sudo nft delete set ip filter eip

总结：很强大的nftables 还有很多高级功能这需要你自行挖掘了。如果你不需要封禁IP段可以省略脚本步骤（脚本只要是把IP或IP段导入到nftables）

相关文章

‌macOS U盘启动盘

Mac版Adobe Photoshop导出不支持jpg

OpenSSL 3.5.x开启TLS1 TLS1.1

发表回复取消回复