nftables waa mashruuc ku siinaya shaandhaynta baakooyinka iyo kala-soocidda baakooyinka Linux
Siideynta nftables 1.0.7 filter filter ayaa la daabacay, kaas oo la socda xoogaa horumar ah, sixid iyo sidoo kale astaamo cusub.
Kuwa aan aqoon nftables, waa inaad taas ogaataa wuxuu mideeyaa is dhex galka xirmooyinka shaandhaynta ee IPv4, IPV6, ARP, iyo isku xidhka shabakada (loogu talagalay in lagu beddelo iptables, ip6table, arptables, iyo ebtables). Isla mar ahaantaana, maktabadda wehel libnftnl 1.2.3 ayaa la sii daayay, taas oo bixisa API heer hoose ah oo la xidhiidha nidaamka hoose ee nf_tables.
Xidhmada nftables waxaa ku jira qaybaha shaandhada baakadaha ee ka shaqeeya meelaha isticmaalaha, halka heerka kernel, nf_tables subsystem wuxuu bixiyaa qayb ka mid ah kernel Linux ilaa version 3.13.
Heerka xudunta, kaliya waxay bixisaa is-dhexgal guud oo ka madax bannaan borotokool gaar ah oo bixiya ah howlaha aasaasiga ah si looga soo saaro xogta xirmooyinka, loo sameeyo hawlgallada xogta loona xakameeyo socodka.
ka sharciyada sifeynta tooska ah iyo darawalada qaaska ah ee maamuleyaasha waxaa lagu soo ururiyey bytecode goobta isticmaalaha, ka dib markaa bytecode-kan waxaa lagu ridayaa xurunta iyadoo la adeegsanayo shabakadda 'Netlink interface' waxaana lagu fuliyaa kernel-ka mashiin gaar ah oo dalwad ah oo u eg BPF (Filters Berkeley Packet Filters).
Astaamaha ugu muhiimsan ee cusub ee Nftables 1.0.7
Noocan cusub ee ka imanaya nftables 1.0.7, ee ah Linux 6.2+ nidaamyada kernel, ayaa lagu daray Taageerada vxlan, geneve, gre iyo gretap borotokoolka u dhigma, Kaas oo u oggolaanaya tibaaxaha fudud si ay u hubiyaan madaxyada baakadaha la duubay.
Tusaale ahaan, si aad u hubiso ciwaanka IP-ga ee ciwaanka baakidhka VxLAN, waxaad isticmaali kartaa xeerar (adigoon u baahnayn inaad marka hore furto madaxa VxLAN oo aad shaandhada ku xidho interface vxlan0):
Taas waxaa dheer in sidoo kale la iftiimiyayiyo taageerada la hirgeliyay ee si toos ah isku darka haraaga ka dib markii qayb ka mid ah laga saaro shay liiska qaabaynta, ogolaanshaha shay ama qayb ka mid ah kala duwanaanshaha in laga saaro kala duwanaanshaha jira (horay, kala duwan ayaa laga saari karaa oo kaliya dhammaanteed).
Tusaale ahaan, ka dib marka laga saaro shayga 25 liiska u dhexeeya 24-30 iyo 40-50, 24, 26-30, iyo 40-50 waxay ku sii jiri doonaan liiska. Hagaajinta looga baahan yahay ku biirinta tooska ah ee shaqada ayaa lagu bixin doonaa siidaynta balastar ee 5.10+ laamaha kernel ee deggan.
Waxaa kale oo la xusay in lagu daray taageerada oraahda "ugu dambeysay", in ogolaanaya in la ogaado markii ugu danbeysay ee element ee xeerka ama liiska qaabeynta la isticmaalay. Tilmaamahan waa la taageeray ilaa Linux kernel 5.14.
Dhinaca kale, waxaa sidoo kale la iftiimiyay taas amar cusub oo "burburin" ayaa lagu daray si aad uga saarto walxaha si shuruud la'aan ah (si ka duwan amarka saar, ma kiciso ENOENT marka la isku dayayo in la saaro shay maqan). Waxay u baahan tahay ugu yaraan Linux 6.3-rc kernel si uu u shaqeeyo.
- Isticmaalka joogtada ah ee liisaska dejisan waa la oggol yahay. Tusaale ahaan, adigoo isticmaalaya liiska ciwaanka aad ku socoto iyo VLAN ID furaha ahaan, waxaad si toos ah u cayimi kartaa lambarka VLAN (daddr. 123):
- Lagu daray awoodda lagu qeexo kootada liiska qaabeynta. Tusaale ahaan, si loo qeexo kootada taraafikada ee ciwaanka IP-ga loo socdo, waxaad cayimi kartaa .
- Oggolow xiriirada iyo kala duwanaanta in loo isticmaalo turjumaada ciwaanka (NAT) khariidaynta.
Finalmente kuwa doonaya inay wax badan ka ogaadaan Waxyaabaha ku saabsan noocaan cusub, waad iska hubin kartaa faahfaahinta Xiriirka soo socda.
Sidee loo rakibaa nooca cusub ee nftables 1.0.7?
Kuwa danaynaya inay awoodaan inay helaan nooca cusub ee nftables 1.0.7 xilligan kaliya koodhka isha ayaa la ururin karaa nidaamkaaga. Inkasta oo maalmo gudahood xirmooyinka binary ee horey loo soo ururiyey laga heli doono qaybaha kala duwan ee Linux.
Si aad u ururiso, waa inaad haysataa ku-tiirsanaanta soo socota:
Kuwaas waxaa lagu soo ururin karaa:
./autogen.sh ./configure make make install
Iyo nftable 1.0.5 ayaan ka soo degsanaa xiriirka soo socda. Isku soo uruurinta waxaa lagu sameeyaa amarrada soo socda:
cd nftables ./autogen.sh ./configure make make install