Nytro Posted January 10, 2014 Report Posted January 10, 2014 [h=1]NFTables IPTables-Replacement Queued For Linux 3.13[/h]Posted by Michael Larabel in Linux Kernel on 19 October 2013 03:42 PM EDTNFTables is a new firewall subsystem / packet filtering engine for the Linux kernel that is poised to replace iptables. NFTables has been in development for several years by the upstream author of Netfilter. This new nftables system is set to be merged now into the Linux 3.13 kernel. NFTables has been in development for years and to replace IPTables by offering a simpler kernel ABI, reduce code duplication, improved error reporting, and provide more efficient support of filtering rules. Beyond IPTables, it also replaces the ip6tables, arptables, and ebtables frameworks but nftables does offer a compatibility layer to iptables support. For those into networking and wanting to learn more about NFTables, visit its Netfilter.org project page. Earlier this week a pull request was sent in for pulling in nf_tables for the next Linux kernel release through the net-next branch. The pull request was accepted and is now living in the net-next Git repository for Linux 3.13. IPTables won't die off in Linux 3.13 as there's still work ahead for NFTables, but those wanting to try out the new code when it's mainlined can find this how-to guide.Sursa: [Phoronix] NFTables IPTables-Replacement Queued For Linux 3.13 Quote
u0m3 Posted January 10, 2014 Report Posted January 10, 2014 Era interesant daca reuseau sa integreze si QoS in firewall, cam ca PF din OpenBSD. Quote
aelius Posted January 11, 2014 Report Posted January 11, 2014 Ai QoS si pe iptablesAi targetul 'TOS', dar nu se compara. E ceva low end. In plus sunt doar 5 optiuni sinistre. Atentie, vorbim de netfilter nu de tc din pachetul iproute2Functioneaza foarte empiric prioridizant pachetele, atata tot. Quote
PingLord Posted January 11, 2014 Report Posted January 11, 2014 Daca nu ai target de QoS asta nu inseamna ca nu poti face QoS . Check hashlimit si Connmark Quote
aelius Posted January 11, 2014 Report Posted January 11, 2014 Domnu, fai asta cu iptables (vezi ce e cu bold). Connmark este pentru marcarea pachetelor iar cu hashlimit definesti o rata de pachete intr-o unitate de timp, nicidecum o latime de banda.ext_if = "hme0"ext_if2 = "hme1"int_if = "hme2"ext_gw2 = "192.168.1.1"protocols = "{ tcp, udp, icmp, gre, ipv6, esp, ipencap }"icmp_types = "{ echoreq, unreach }"state_inspection = "flags S/SAFR modulate state"udpblock = "{ 22, 80, 443 }"ftp_ports = "{ 20:21 }"passive = "{ 32000:63000 }"voipports = "{ 5060, 5061, 5062, 5063, 5064 }"torrent = "{ 6881:6999 }"table <BLACKLIST> persist file "/etc/firewall/blacklist"table <SLOWQUEUE> persist file "/etc/firewall/slowqueue"set fingerprints "/etc/firewall/os-fingerprint"set block-policy dropset optimization aggressive#set ruleset-optimization basic# http://kestas.kuliukas.com/pf.conf/#NATQueueingset state-policy if-boundset optimization normalset loginterface $ext_ifset skip on lo0set skip on tun0set skip on hme1set skip on hme3set skip on gif0set skip on gre0set skip on $int_ifset require-order yesset timeout { frag 10, tcp.established 3600, interval 5 }set timeout { tcp.first 30, tcp.closing 30, tcp.closed 30, tcp.finwait 30 }set timeout { udp.first 30, udp.single 30, udp.multiple 30 }set timeout { other.first 30, other.single 30, other.multiple 30 }set timeout { adaptive.start 0, adaptive.end 0 }set limit { states 32000000, frags 32000000, src-nodes 320000000, tables 32000000, table-entries 32000000 }scrub on $ext_if all random-id reassemble tcp fragment reassemble[B]altq on $int_if bandwidth 100Mb hfsc queue { ether, nattraffic }queue nattraffic hfsc ( upperlimit 400Kb ) bandwidth 420Kb { toint_pri, toint_def }queue toint_pri qlimit 10 hfsc ( red, realtime 35%, linkshare 50% ) priority 4 bandwidth 70%queue toint_def qlimit 10 hfsc ( red, realtime 15%, linkshare 30% ) priority 3 bandwidth 20%altq on $ext_if priq bandwidth 2.0Mb qlimit 800 queue { ftp, ssh, web, voip, icmp, torrent, other } queue other qlimit 200 priority 5 priq(rio,default) queue ftp qlimit 50 priority 2 priq(rio,ecn) queue web qlimit 300 priority 14 priq(rio,ecn) queue voip qlimit 500 priority 15 priq(red) queue ssh qlimit 50 priority 4 priq(red) queue icmp qlimit 50 priority 3 priq(red) queue torrent qlimit 20 priority 6 priq(rio,ecn)[/B]nat from 10.0.0.2 to any -> ($ext_if) # Workstationnat from 10.0.0.3 to any -> ($ext_if) # Voipnat from 10.0.0.4 to any -> ($ext_if) # SUNnat from 10.0.0.5 to any -> ($ext_if) # NetBSDnat from 10.0.0.6 to any -> ($ext_if) # VMnat from 10.0.0.7 to any -> ($ext_if) # IBMnat from 10.0.0.8 to any -> ($ext_if) # HPnat from 10.0.0.9 to any -> ($ext_if) # Alina (Wireless)nat from 10.0.0.10 to any -> ($ext_if) # HP Printernat from 10.0.0.11 to any -> ($ext_if) # Netgear Wirelessnat from 10.0.0.12 to any -> ($ext_if) # Server nounat from 172.16.0.2 to any -> ($ext_if) # texnat from 192.168.1.0/24 to any -> ($ext_if) # VPN# HPrdr on $ext_if inet proto tcp from any to $ext_if port { 20, 21, 22, 53, 81, 443 } tag HP -> 10.0.0.8rdr on $ext_if inet proto udp from any to $ext_if port { 20, 21 } tag HP -> 10.0.0.8rdr on $ext_if2 inet proto tcp from any to $ext_if2 tag HP-PRINTER -> 10.0.0.10rdr on $ext_if inet proto tcp from any to $ext_if port $passive -> 10.0.0.8# vmrdr on $ext_if inet proto tcp from any to $ext_if port 400 -> 10.0.0.6 port 22rdr on $ext_if inet proto tcp from any to $ext_if port 515 -> 10.0.0.7 port 22# VoIPrdr on $ext_if inet proto tcp from any to $ext_if port $voipports tag VOIP -> 10.0.0.3rdr on $ext_if inet proto udp from any to $ext_if port $voipports tag VOIP -> 10.0.0.3no rdrblock in quick on $ext_if from <SLOWQUEUE> to any probability 97%block in quick on $ext_if from <BLACKLIST> to anyblock out quick on $ext_if from any to <BLACKLIST>block in quick on $ext_if proto tcp from <HTTP_OVERLOAD> to any port 80block in quick on $ext_if proto tcp from <HTTPS_OVERLOAD> to any port 443block in quick on $ext_if proto tcp from <SSH_ABUSIVE> to any port 22block in quick on $ext_if proto tcp from <FTP_ABUSIVE> to any port 21## UDP DDoS Blockblock in quick on $ext_if proto udp from any to any port { !=20, !=1723 }## Junoblock in quick on $ext_if proto tcp from any port { 1024,3072 } to anyblock out quick on $ext_if proto tcp from any to any port { 1024,3072 }block in on $ext_ifblock out on $ext_ifset skip on lo0antispoof for $ext_if inet # disabled for vpnblock in from no-route to anyblock in from urpf-failed to anyblock in quick on $ext_if proto tcp flags FUP/WEUAPRSFblock in quick on $ext_if proto tcp flags WEUAPRSF/WEUAPRSFblock in quick on $ext_if proto tcp flags SRAFU/WEUAPRSFblock in quick on $ext_if proto tcp flags /WEUAPRSFblock in quick on $ext_if proto tcp flags SR/SRblock in quick on $ext_if proto tcp flags SF/SFpass out quick on $ext_if route-to ($ext_if2 $ext_gw2) from { 192.168.1.0/24 } to anyblock in quick on $ext_if from any to 255.255.255.255pass out on $ext_if proto tcp from any port 21 to any flags S/SA modulate state queue ftppass out on $ext_if proto tcp from any port 22 to any flags S/SA modulate state queue sshpass out on $ext_if proto tcp from any port 80 to any flags S/SA modulate state queue webpass out on $ext_if proto tcp from any port $torrent to any flags S/SA modulate state queue torrentpass out on $ext_if proto tcp from any port $voipports to any keep state queue voippass out on $ext_if proto tcp from any to any flags S/SA modulate state queue otherpass out on $ext_if proto icmp from any to any keep state queue icmppass out on $ext_if proto { udp, gre, ipv6, esp, ipencap } from any to any keep statepass in on { $int_if, $ext_if } proto tcp from any to any port 515 $state_inspectionpass in on $ext_if proto { tcp, udp } from any to any port 1723 keep statepass in quick on $ext_if all allow-optspass in on $ext_if proto tcp from any to any port 80 $state_inspection \ (source-track rule, max-src-conn 180, max-src-conn-rate 140/1, overload <HTTP_OVERLOAD> flush global) tag HTTP-SERVICEpass in on $ext_if proto tcp from any to any port 443 $state_inspection \ (source-track rule, max-src-conn 180, max-src-conn-rate 140/1, overload <HTTPS_OVERLOAD> flush global) tag HTTPS-SERVICEpass in on $ext_if proto tcp from any to any port 22 $state_inspection \ (source-track rule, max-src-conn 10, max-src-conn-rate 1/60, max-src-nodes 20, overload <SSH_ABUSIVE> flush global) tag SSHD-SERVICEpass in on $ext_if proto tcp from any to any port 81 keep statepass in on $ext_if proto tcp from any to any port 554 keep statepass in on $ext_if proto tcp from any to any port $ftp_ports $state_inspection \ (source-track rule, max-src-conn 30, max-src-conn-rate 30/1, overload <FTP_OVERLOAD> flush global) tag FTP-SERVICEpass in on $ext_if proto udp from any to any port $ftp_ports keep statepass in on $ext_if proto tcp from any to any port $passive keep statepass in on $ext_if proto udp from any to any port $passive keep statepass in on $ext_if proto tcp from any to any port { 5060, 5061 } keep state tag VOIP-INpass in on $ext_if proto {tcp, udp} from any to any port 2222 keep state tag WRT# allow traceroute outpass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep state Quote
