Projet

Général

Profil

Modifier Historique

Wiki » Divers »

Nftables » Historique » Version 6

Mehdi Abaakouk, 29/03/2014 09:58

1 1 Laurent GUERBY 
{{>toc}}
2 1 Laurent GUERBY 





    3
    1
    Laurent GUERBY
    
h1. Nftables





    4
    1
    Laurent GUERBY
    





    5
    1
    Laurent GUERBY
    
h2. Liens





    6
    1
    Laurent GUERBY
    





    7
    1
    Laurent GUERBY
    
* https://wiki.archlinux.org/index.php/Nftables





    8
    1
    Laurent GUERBY
    
* https://home.regit.org/netfilter-en/nftables-quick-howto/





    9
    2
    Laurent GUERBY
    
* http://wiki.nftables.org/





    10
    1
    Laurent GUERBY
    





    11
    1
    Laurent GUERBY
    
h2. Examples





    12
    1
    Laurent GUERBY
    





    13
    3
    Laurent GUERBY
    
h3. Tools





    14
    3
    Laurent GUERBY
    





    15
    1
    Laurent GUERBY
    
<pre>





    16
    1
    Laurent GUERBY
    
root@h7:~# nft --version





    17
    1
    Laurent GUERBY
    
nftables v0.100 (keith-alexander-filter)





    18
    1
    Laurent GUERBY
    
root@h7:~# cat /proc/version 





    19
    1
    Laurent GUERBY
    
Linux version 3.14-rc7-amd64 (debian-kernel@lists.debian.org) (gcc version 4.8.2 (Debian 4.8.2-16) ) #1 SMP Debian 3.14~rc7-1~exp1 (2014-03-17)





    20
    1
    Laurent GUERBY
    
</pre>





    21
    1
    Laurent GUERBY
    





    22
    5
    Laurent GUERBY
    
h3. UDP counter





    23
    3
    Laurent GUERBY
    





    24
    1
    Laurent GUERBY
    
<pre>





    25
    1
    Laurent GUERBY
    
root@h7:~# nft add rule filter output udp dport 0-65535 ip daddr 91.224.149.151 counter





    26
    1
    Laurent GUERBY
    
root@h7:~# nft list chain filter output -a -n





    27
    1
    Laurent GUERBY
    
table ip filter {





    28
    1
    Laurent GUERBY
    
	chain output {





    29
    1
    Laurent GUERBY
    
		 type filter hook output priority 0;





    30
    1
    Laurent GUERBY
    
		 ip protocol udp udp dport >= 0 udp dport <= 65535 counter packets 171479 bytes 256167178 # handle 13





    31
    1
    Laurent GUERBY
    
		 ip protocol udp udp dport >= 0 udp dport <= 65535 ip daddr 91.224.149.151 counter packets 0 bytes 0 # handle 15





    32
    1
    Laurent GUERBY
    
	}





    33
    1
    Laurent GUERBY
    
}





    34
    1
    Laurent GUERBY
    
root@h7:~# iperf -c 91.224.149.151 -u -b 100M





    35
    1
    Laurent GUERBY
    
------------------------------------------------------------





    36
    1
    Laurent GUERBY
    
Client connecting to 91.224.149.151, UDP port 5001





    37
    1
    Laurent GUERBY
    
Sending 1470 byte datagrams





    38
    1
    Laurent GUERBY
    
UDP buffer size:  208 KByte (default)





    39
    1
    Laurent GUERBY
    
------------------------------------------------------------





    40
    1
    Laurent GUERBY
    
[  3] local 91.224.149.2 port 41909 connected with 91.224.149.151 port 5001





    41
    1
    Laurent GUERBY
    
[ ID] Interval       Transfer     Bandwidth





    42
    1
    Laurent GUERBY
    
[  3]  0.0-10.0 sec   120 MBytes   100 Mbits/sec





    43
    1
    Laurent GUERBY
    
[  3] Sent 85471 datagrams





    44
    1
    Laurent GUERBY
    
read failed: Connection refused





    45
    1
    Laurent GUERBY
    
[  3] WARNING: did not receive ack of last datagram after 1 tries.





    46
    1
    Laurent GUERBY
    
root@h7:~# nft list chain filter output -a -n





    47
    1
    Laurent GUERBY
    
table ip filter {





    48
    1
    Laurent GUERBY
    
	chain output {





    49
    1
    Laurent GUERBY
    
		 type filter hook output priority 0;





    50
    1
    Laurent GUERBY
    
		 ip protocol udp udp dport >= 0 udp dport <= 65535 counter packets 256951 bytes 384184664 # handle 13





    51
    1
    Laurent GUERBY
    
		 ip protocol udp udp dport >= 0 udp dport <= 65535 ip daddr 91.224.149.151 counter packets 85457 bytes 128014586 # handle 15





    52
    1
    Laurent GUERBY
    
	}





    53
    1
    Laurent GUERBY
    
}





    54
    1
    Laurent GUERBY
    
root@h7:~# nft delete rule filter output handle 15





    55
    1
    Laurent GUERBY
    
root@h7:~# nft list chain filter output -a -n





    56
    1
    Laurent GUERBY
    
table ip filter {





    57
    1
    Laurent GUERBY
    
	chain output {





    58
    1
    Laurent GUERBY
    
		 type filter hook output priority 0;





    59
    1
    Laurent GUERBY
    
		 ip protocol udp udp dport >= 0 udp dport <= 65535 counter packets 256982 bytes 384190532 # handle 13





    60
    1
    Laurent GUERBY
    
	}





    61
    1
    Laurent GUERBY
    





    62
    1
    Laurent GUERBY
    
</pre>





    63
    1
    Laurent GUERBY
    





    64
    1
    Laurent GUERBY
    
<pre>





    65
    1
    Laurent GUERBY
    
nft add rule filter output udp dport 0-65535 counter





    66
    1
    Laurent GUERBY
    
nft add rule filter input ip daddr 91.224.149.2 counter





    67
    3
    Laurent GUERBY
    
</pre>





    68
    3
    Laurent GUERBY
    





    69
    3
    Laurent GUERBY
    
h3. Log





    70
    3
    Laurent GUERBY
    





    71
    3
    Laurent GUERBY
    
<pre>





    72
    4
    Laurent GUERBY
    
root@h7:~# modprobe xt_LOG  





    73
    3
    Laurent GUERBY
    
root@h7:~# nft add rule filter output ip daddr 91.224.149.151 counter





    74
    3
    Laurent GUERBY
    
root@h7:~# nft add rule filter output ip daddr 91.224.149.151 log





    75
    3
    Laurent GUERBY
    
root@h7:~# nft list chain filter output -a -n





    76
    3
    Laurent GUERBY
    
table ip filter {





    77
    3
    Laurent GUERBY
    
	chain output {





    78
    3
    Laurent GUERBY
    
		 type filter hook output priority 0;





    79
    3
    Laurent GUERBY
    
		 ip daddr 91.224.149.151 counter packets 0 bytes 0 # handle 16





    80
    3
    Laurent GUERBY
    
		 ip daddr 91.224.149.151 log # handle 17





    81
    3
    Laurent GUERBY
    
	}





    82
    3
    Laurent GUERBY
    
}





    83
    3
    Laurent GUERBY
    
root@h7:~# ping -c 1 91.224.149.151





    84
    3
    Laurent GUERBY
    
PING 91.224.149.151 (91.224.149.151) 56(84) bytes of data.





    85
    3
    Laurent GUERBY
    
64 bytes from 91.224.149.151: icmp_seq=1 ttl=64 time=2.53 ms





    86
    3
    Laurent GUERBY
    





    87
    3
    Laurent GUERBY
    
--- 91.224.149.151 ping statistics ---





    88
    3
    Laurent GUERBY
    
1 packets transmitted, 1 received, 0% packet loss, time 0ms





    89
    3
    Laurent GUERBY
    
rtt min/avg/max/mdev = 2.530/2.530/2.530/0.000 ms





    90
    3
    Laurent GUERBY
    





    91
    3
    Laurent GUERBY
    
Message from syslogd@h7 at Mar 28 14:38:08 ...





    92
    3
    Laurent GUERBY
    
 kernel:[ 6797.701781] IN= OUT=eth0.3131 SRC=91.224.149.2 DST=91.224.149.151 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=7861 DF PROTO=ICMP TYPE=8 CODE=0 ID=26178 SEQ=1 UID=0 GID=0 





    93
    3
    Laurent GUERBY
    
root@h7:~# nft list chain filter output -a -n





    94
    3
    Laurent GUERBY
    
table ip filter {





    95
    3
    Laurent GUERBY
    
	chain output {





    96
    3
    Laurent GUERBY
    
		 type filter hook output priority 0;





    97
    3
    Laurent GUERBY
    
		 ip daddr 91.224.149.151 counter packets 1 bytes 84 # handle 16





    98
    3
    Laurent GUERBY
    
		 ip daddr 91.224.149.151 log # handle 17





    99
    3
    Laurent GUERBY
    
	}





    100
    1
    Laurent GUERBY
    
}





    101
    4
    Laurent GUERBY
    
root@h7:~# nft delete rule filter output handle 17





    102
    4
    Laurent GUERBY
    
root@h7:~# tail -1 /var/log/syslog 





    103
    4
    Laurent GUERBY
    
Mar 28 14:38:08 h7 kernel: [ 6797.701781] IN= OUT=eth0.3131 SRC=91.224.149.2 DST=91.224.149.151 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=7861 DF PROTO=ICMP TYPE=8 CODE=0 ID=26178 SEQ=1 UID=0 GID=0 





    104
    1
    Laurent GUERBY
    
</pre>





    105
    6
    Mehdi Abaakouk
    





    106
    6
    Mehdi Abaakouk
    
h2. Pre-requis





    107
    6
    Mehdi Abaakouk
    





    108
    6
    Mehdi Abaakouk
    
* Debian jessie





    109
    6
    Mehdi Abaakouk
    
* Kernel from experimental: https://packages.debian.org/fr/experimental/linux-image-3.14-rc7-amd64





    110
    6
    Mehdi Abaakouk
    
* libnfnl package compiled from https://github.com/aborrero/pkg-libnftnl (bientot dans debian sid: https://ftp-master.debian.org/new/libnftnl_1.0.0+git20140122-1.html)





    111
    6
    Mehdi Abaakouk
    
* nftales package compiled from: http://mentors.debian.net/debian/pool/main/n/nftables/nftables_0.100-1.dsc