Live Life Link

1
sudo pacman -S nftables

1
sudo systemctl list-units --type=service | grep -E "firewalld|ufw"
2
sudo iptables -L -n -v # 谁有输出就禁用

1
sudo systemctl enable --now nftables.service
2
sudo systemctl status nftables.service #查看防火墙状态

1
sudo nft list ruleset

1
sudo nft flush ruleset

1
sudo nft -f /path/to/filename # nftables的配置文件

1
sudo nft add table family_type table_name

1
sudo nft list tables

1
sudo nft list table family_type table_name

1
sudo nft delete table family_type table_name

1
sudo nft flush table family_type table_name

1
sudo nft add rule family_type table_name chain_name handle handle_value  ruler
2
# handle 一个唯一的ID 用来删除、替换、插入的。

1
table inet ssh_protect {
2
    # 定义一个动态黑名单集合
3
    set ssh_blacklist {
4
        type ipv4_addr
5
        flags dynamic, timeout
6
        timeout 1h
7
        size 65536
8
    }
9

10
    chain input {
11
        type filter hook input priority 0; policy accept;
12

13
        ip saddr @ssh_blacklist drop
14
        # 如果源 IP 在黑名单中，直接丢弃
15

16
        tcp dport 22 ct state new \
17
        # 检测 SSH 新连接，超过速率限制则加入黑名单
18
            limit rate over 10/minute burst 5 packets \
19
            add @ssh_blacklist { ip saddr timeout 1h } \
20
            accept
21
    }
22
}

1
map map_name {
2
    type key_type: value_type
3
    elements = { key : value, key1 : value1 }
4

5
}

1
table ip nat {
2
    map port_redirect {
3
        type inet_service : inet_service
4
        elements = { 80 : 8080, 443 : 8443 }
5
    }
6

7
    chain prerouting {
8
        type nat hook prerouting priority dstnat;
9
        tcp dport @port_redirect dnat to 192.168.1.10 : @port_redirect
10
    }
11
}
12
# 访问本机的80 / 443 端口会被转发到 192.168.0.10 的 8080 / 8443 端口上

1
table inet filter {
2
    map service_dispatch {
3
        type inet_service : verdict
4
        elements = {
5
            22  : jump ssh_chain,
6
            23122  : jump ssh_chain,
7
            80  : jump web_chain,
8
            443 : jump web_chain
9
        }
10
    }
11

12
    chain input {
13
        type filter hook input priority 0; policy drop ;
14
        tcp dport vmap @service_dispatch
15
    }
16

17
    chain ssh_chain {
18
        tcp dport 22 drop
19
        tcp dport 23122 accept
20
    }
21

22
    chain web_chain {
23
        tcp dport {80,443} accept
24
    }
25
}
26
# 把不同的端口映射到不同的链上

1
table inet filter {
2
    map ip_policy {
3
        type ipv4_addr : verdict
4
        elements = {
5
            192.168.1.100 : accept,
6
            10.0.0.5      : drop
7
        }
8
    }
9

10
    chain input {
11
        type filter hook input priority 0; policy drop ;
12
        ip saddr vmap @ip_policy
13
    }
14
}
15
# 不同来源的IP走不同的链

1
flush ruleset
2

3
table inet myfw {
4
    # 黑名单集合
5
    set ssh_blacklist {
6
        type ipv4_addr
7
        flags dynamic, timeout
8
        timeout 1h
9
    }
10

11
    # 对象：计数器 + 限速器
12
    counter ssh_counter
13
    limit ssh_limit { rate 10/minute burst 5 }
14

15
    chain input {
16
        type filter hook input priority 0; policy drop;
17

18
        # 基础放行
19
        ct state established,related accept
20
        iif lo accept
21

22
        # 黑名单
23
        ip saddr @ssh_blacklist drop
24

25
        # SSH 防护：速率限制 + 计数 + 自动拉黑
26
        tcp dport 22 ct state new limit name ssh_limit counter name ssh_counter \
27
            add @ssh_blacklist { ip saddr timeout 1h } drop
28

29
        # 允许 Web 服务
30
        tcp dport {80,443} accept
31
    }
32
}