nftables - Vprašanja...

Pozdarvljeni.

Po novem sem začel uprabljati nftables (prej iptables). Vsaj na začetku je kr štala razumet novo sintakso...

In imam nekaj vprašanj.

- Kako logirati drop pakete npr. v /var/log/nftables/drop.log (po defaultu gre vse v /var/log/syslog)
- Ali je pomemben vrsni red ukazov? Se pravi, da gre "find first match" od vrha navzdol, in ko je prvi match, se ta izvede.
- Čemu služi "policy drop" znotraj chain-a?
- Če ima kdo kakšen sample za output chain, če lahko pokaže. Ker bi rad ta promet vsaj malo omejil.
- Kaj pomeni ct na začetku vrstice? ( 1.3.1.21 Ct )

To bo to zaenkrat.

Trenutni config:

#!/usr/sbin/nft -f

flush ruleset

define home_ip = { 1.2.3.4/32 }
define server_ip = { 4.3.2.1/32 }

define ssh_server = { 22 }
define dns_server = { 53 }
define http_server = { 80 }
define https_server = { 443 }

table inet filter {
        chain input {
                type filter hook input priority 0;

                # Established/related connections
                ct state established,related accept;
                ct state invalid drop;

                # ICMP
                #ip protocol icmp icmp type { echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } accept;
                ip protocol icmp icmp type { echo-request } ct state new accept;

                # Allow SSH from home IP
                ip saddr $home_ip ip daddr $server_ip tcp dport 22 accept;

                # Allow DNS from public
                ip daddr $server_ip tcp dport $dns_server accept;

                # Allow HTTP(S) from public
                ip daddr $server_ip tcp dport $http_server accept;
                ip daddr $server_ip tcp dport $https_server accept;

                # Log traffic
                counter log prefix ">>>nftables-drop<<<: " drop;

                # Dont know yet...
                policy drop;
        }
        chain forward {
                type filter hook forward priority 0;

                # Own routing
                policy drop;
        }
        chain output {
                type filter hook output priority 0;

                # Allow all out
                policy accept;
        }
}