Advanced Pagina 7 - Revizia istoricului

Admin la 13 noiembrie 2024 09:24

2024-11-13T09:24:03Z

← Versiunea anterioară		Versiunea de la data 13 noiembrie 2024 09:24
Linia 115:		Linia 115:
	====Operatii la nivel de ruleset====		====Operatii la nivel de ruleset====

	~~listing~~		'''Listarea'''

	Listing the complete ruleset:		Listing the complete ruleset:
Linia 132:		Linia 132:
	These commands will print all tables/chains/sets/rules of the given family.		These commands will print all tables/chains/sets/rules of the given family.

	~~flushing~~		'''Curatarea'''

	In addition, you can also flush (erase, delete, wipe) the complete ruleset:		In addition, you can also flush (erase, delete, wipe) the complete ruleset:
Linia 146:		Linia 146:
	% nft flush ruleset inet		% nft flush ruleset inet

	~~backup~~/~~restore~~		'''Backup/restaurare'''

	You can combine these two commands above to backup your ruleset:		You can combine these two commands above to backup your ruleset, then load it atomically:

	% echo "flush ruleset" > backup.nft		% echo "flush ruleset" > backup.nft
	% nft list ruleset >> backup.nft		% nft list ruleset >> backup.nft

	~~And load it [[Atomic_rule_replacement\|atomically]]:~~

	% nft -f backup.nft		% nft -f backup.nft

	~~Listing~~ in JSON ~~format~~		'''Listarea in format JSON'''

	You can also export your ruleset in JSON format, just pass the		You can also export your ruleset in JSON format, just pass the

Admin la 12 noiembrie 2024 11:34

2024-11-12T11:34:58Z

← Versiunea anterioară		Versiunea de la data 12 noiembrie 2024 11:34
Linia 165:		Linia 165:

	====Creare regula blocare ip-uri (nativa)====		====Creare regula blocare ip-uri (nativa)====

	~~-''functia ipv(4\|6)_validate este un grep pe clase de ip-uri, nu este necesar pentru o lista simpla.''~~

	~~-''Numarul de reguli verificabil cu " nft list table inet filter \| grep -oc ',' "''~~

	<pre>		<pre>
Linia 179:		Linia 175:
	insert rule inet filter INPUT ip6 saddr @ipmaster6 counter drop		insert rule inet filter INPUT ip6 saddr @ipmaster6 counter drop
	' \| nft -f -		' \| nft -f -
	ipv4_validate <~~/tmp/ip_lists~~ \| awk '{print "add element inet filter ipmaster { "$1" }"}' \| nft -f - # import ipv4		ipv4_validate <lista_ip \| awk '{print "add element inet filter ipmaster { "$1" }"}' \| nft -f - # import ipv4
	ipv6_validate <~~/tmp/ip_lists~~ \| awk '{print "add element inet filter ipmaster6 { "$1" }"}' \| nft -f - # import ipv6		ipv6_validate <lista_ip \| awk '{print "add element inet filter ipmaster6 { "$1" }"}' \| nft -f - # import ipv6
	</pre>		</pre>

			'''Note:'''

			-''functia ipv(4\|6)_validate este un grep pe clase de ip-uri, nu este necesar pentru o lista simpla.''

			-''Numarul de reguli verificabil cu " nft list table inet filter \| grep -oc ',' " ''

			-''Verificarea numarului de "hits" catre adresele blocate se poate face cu " ip(6)tables -vL " sau insumat cu:''

			perl -E '/packets (\d+)/ and $s += $1 for `nft list ruleset \| grep ipmaster`; say $s'


	====Creare regula conectare vpn wireguard (nativa)====		====Creare regula conectare vpn wireguard (nativa)====

	<pre>		<pre>
	[[ -n $wg_file ]] && file=$wg_file \|\| file=$opt_file; ! [[ -s $file ]] && return 1; iname=$(basename -s .conf $file) address=$(grep '^Address' $file \| ipv4_validate) address6=$(grep '^Address' $file \| ipv6_validate)		[[ -n $wg_file ]] && file=$wg_file \|\| file=$opt_file; ! [[ -s $file ]] && return 1; iname=$(basename -s .conf $file) address=$(grep '^Address' $file \| ipv4_validate) address6=$(grep '^Address' $file \| ipv6_validate)
Linia 208:		Linia 216:

	===iptables===		===iptables===

			Regulile se pot incarca cu comanda iptables-restore sau se pot salva in /etc/sysconfig/iptables

	====Exemplu 1====		====Exemplu 1====
Linia 470:		Linia 480:

	<pre>		<pre>
	ipv4_validate <~~/tmp/ip_lists~~ \| awk 'NR==1{print "create ipmaster hash:net family inet hashsize 100000 maxelem 100000"}''{print "add ipmaster "$1}' \| ipset restore -!		ipv4_validate <lista_ip \| awk 'NR==1{print "create ipmaster hash:net family inet hashsize 100000 maxelem 100000"}''{print "add ipmaster "$1}' \| ipset restore -!
	iptables -I INPUT -m set --match-set ipmaster src -j DROP ~~\|\| ierr=1~~ # import ipv4		iptables -I INPUT -m set --match-set ipmaster src -j DROP # import ipv4
	ipv6_validate <~~/tmp/ip_lists~~ \| awk 'NR==1{print "create ipmaster6 hash:net family inet6 hashsize 500000 maxelem 500000"}''{print "add ipmaster6 "$1}' \| ipset restore -!		ipv6_validate <lista_ip \| awk 'NR==1{print "create ipmaster6 hash:net family inet6 hashsize 500000 maxelem 500000"}''{print "add ipmaster6 "$1}' \| ipset restore -!
	ip6tables -I INPUT -m set --match-set ipmaster6 src -j DROP ~~\|\| ierr=1~~ # import ipv6		ip6tables -I INPUT -m set --match-set ipmaster6 src -j DROP # import ipv6
	</pre>		</pre>

			'''Note:'''

			-''functia ipv(4\|6)_validate este un grep pe clase de ip-uri, nu este necesar pentru o lista simpla.''

			-''Numarul de reguli verificabil cu " ipset list -t " sau insumat cu:''

			perl -E '/Number of entries: (\d+)/ and $s += $1 for `ipset list -t`; say $s'

			-''Verificarea numarului de "hits" catre adresele blocate se poate face cu " ip(6)tables -vL " sau insumat cu:''

			perl -E "say $(iptables -vL \| awk 'NR==3{print $1}') + $(ip6tables -vL \| awk 'NR==3{print $1}')"

	[[Advanced_Pagina_6\|Pagina anterioară]] \| [[Advanced_Pagina_8\|Următoarea pagină]]		[[Advanced_Pagina_6\|Pagina anterioară]] \| [[Advanced_Pagina_8\|Următoarea pagină]]

Admin la 12 noiembrie 2024 11:10

2024-11-12T11:10:55Z

Afișare diferențe

Admin la 11 noiembrie 2024 14:12

2024-11-11T14:12:21Z

← Versiunea anterioară		Versiunea de la data 11 noiembrie 2024 14:12
Linia 166:		Linia 166:
	% nft --json list ruleset > ruleset.json		% nft --json list ruleset > ruleset.json

	====Creare regula blocare ip-uri ~~de sine statoare~~====		====Creare regula blocare ip-uri (nativa)====

	-''functia ipv(4\|6)_validate este un grep pe clase de ip-uri, nu este necesar pentru o lista simpla.''		-''functia ipv(4\|6)_validate este un grep pe clase de ip-uri, nu este necesar pentru o lista simpla.''

	-''Numarul de reguli verificabil cu " nft list table inet ~~utilities_filter~~ \| grep -oc ',' "''		-''Numarul de reguli verificabil cu " nft list table inet filter \| grep -oc ',' "''

	<pre>		<pre>
	~~if ! nft list chain inet filter INPUT >$quiet 2>&1; then~~
	echo '		echo '
	add table inet filter		add table inet filter
Linia 181:		Linia 180:
	insert rule inet filter INPUT ip saddr @ipmaster counter drop		insert rule inet filter INPUT ip saddr @ipmaster counter drop
	insert rule inet filter INPUT ip6 saddr @ipmaster6 counter drop		insert rule inet filter INPUT ip6 saddr @ipmaster6 counter drop
	' \| nft -f -~~; fi~~		' \| nft -f -
	ipv4_validate </tmp/ip_lists \| awk '{print "add element inet filter ipmaster { "$1" }"}' \| nft -f - # import ipv4		ipv4_validate </tmp/ip_lists \| awk '{print "add element inet filter ipmaster { "$1" }"}' \| nft -f - # import ipv4
	ipv6_validate </tmp/ip_lists \| awk '{print "add element inet filter ipmaster6 { "$1" }"}' \| nft -f - # import ipv6		ipv6_validate </tmp/ip_lists \| awk '{print "add element inet filter ipmaster6 { "$1" }"}' \| nft -f - # import ipv6
			</pre>

			====Creare regula conectare vpn wireguard (nativa)====
			<pre>
			[[ -n $wg_file ]] && file=$wg_file \|\| file=$opt_file; ! [[ -s $file ]] && return 1; iname=$(basename -s .conf $file) address=$(grep '^Address' $file \| ipv4_validate) address6=$(grep '^Address' $file \| ipv6_validate)
			ip link add $iname type wireguard \|\| return 1; wg setconf $iname <(grep -E '^\[Interface\|^\[Peer\|^PrivateKey\|^PublicKey\|^Endpoint\|^AllowedIPs\|^$' $file) \|\| return 1
			ip -4 address add $address dev $iname; ip -6 address add $address6 dev $iname
			grep '^DNS' $file \| sed 's/DNS =/nameserver/' \| resolvconf -a tun."$iname" -m 0 -x
			wg set $iname fwmark 51820
			ip link set mtu 1420 up dev $iname
			sysctl -q net.ipv4.conf.all.src_valid_mark=1
			ip -4 route add 0.0.0.0/0 dev $iname table 51820; ip -6 route add ::/0 dev $iname table 51820
			for cmd in 'ip -4' 'ip -6'; do $cmd rule add not fwmark 51820 table 51820; $cmd rule add table main suppress_prefixlength 0; done
			echo '
			add table inet fw
			add chain inet fw INPUT { type filter hook input priority 0 ; }
			add chain inet fw preraw { type filter hook prerouting priority -300; }
			add rule inet fw preraw iifname != '$iname' ip daddr '$(cut -d/ -f1 <<<$address)' fib saddr type != local drop
			add rule inet fw preraw iifname != '$iname' ip6 daddr '$(cut -d/ -f1 <<<$address6)' fib saddr type != local drop
			add chain inet fw premangle { type filter hook prerouting priority -150; }
			add rule inet fw premangle meta l4proto udp meta mark set ct mark
			add chain inet fw postmangle { type filter hook postrouting priority -150; }
			add rule inet fw postmangle meta l4proto udp mark 51820 ct mark set mark
			' \| nft -f - && echo $iname connected
	</pre>		</pre>

Admin la 11 noiembrie 2024 13:54

2024-11-11T13:54:59Z

Afișare diferențe

Admin: Pagină nouă: ==Firewall avansat== Pagina anterioară | Următoarea pagină

2024-11-08T22:47:02Z

Pagină nouă: ==Firewall avansat== Pagina anterioară | Următoarea pagină

Pagină nouă

==Firewall avansat==
[[Advanced_Pagina_6|Pagina anterioară]] | [[Advanced_Pagina_8|Următoarea pagină]]