首页 iptables教程nft实战-nft备份还原

nft介绍与应用

nft实战-迁移iptables规则到nft

运维派隶属马哥教育旗下专业运维社区,是国内成立最早的IT运维技术社区,欢迎关注公众号:yunweipai
领取学习更多免费Linux云计算、Python、Docker、K8s教程关注公众号:马哥linux运维

备份还原

规则都是临时的,要想永久生效,可以将规则备份,重启后自动加载恢复

查看service文件

[root@centos8 ~]#cat /lib/systemd/system/nftables.service 
[Unit]
Description=Netfilter Tables
Documentation=man:nft(8)
Wants=network-pre.target
Before=network-pre.target

[Service]
Type=oneshot
ProtectSystem=full
ProtectHome=true
ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf
ExecReload=/sbin/nft 'flush ruleset; include "/etc/sysconfig/nftables.conf";'
ExecStop=/sbin/nft flush ruleset
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

备份配置并还原

#备份至文件中
[root@centos8 ~]#nft list ruleset 
table inet filter {
    chain input {
        type filter hook input priority 0; policy accept;
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}
table inet test_table {
    chain test_chain {
        tcp dport mysql reject
        tcp dport http reject
    }

    chain test_filter_input_chain {
        type filter hook input priority 0; policy accept;
        tcp dport mysql reject
        tcp dport ftp reject
        udp dport http-alt reject
        tcp dport http reject
        tcp dport 6379 reject
    }
}

[root@centos8 ~]#nft list ruleset >  /etc/sysconfig/nftables.conf

#删除所有规则
[root@centos8 ~]#nft flush  ruleset 
[root@centos8 ~]#nft list ruleset

#重新启动后全部还原
[root@centos8 ~]#systemctl restart nftables.service 
[root@centos8 ~]#nft list ruleset 
table inet filter {
    chain input {
        type filter hook input priority 0; policy accept;
    }

    chain forward {
        type filter hook forward priority 0; policy accept;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}
table inet test_table {
    chain test_chain {
        tcp dport mysql reject
        tcp dport http reject
    }

    chain test_filter_input_chain {
        type filter hook input priority 0; policy accept;
        tcp dport mysql reject
        tcp dport ftp reject
        udp dport http-alt reject
        tcp dport http reject
        tcp dport 6379 reject
    }
}

启用指定的配置文件

[root@centos8 ~]#cat nftables2.conf
table inet test2_table {
    chain test2_filter_input_chain {
        type filter hook input priority 0; policy accept;
        ip saddr { 10.0.0.1, 10.0.0.10 } accept
        tcp dport { http, nfs,ssh }  reject
    }
}

#-f 指定规则配置文件,如果已经有规则,是追加至现有规则后
[root@centos8 ~]#nft -f nftables2.conf
[root@centos8 ~]#nft list ruleset
table inet test2_table {
    chain test2_filter_input_chain {
        type filter hook input priority 0; policy accept;
        ip saddr { 10.0.0.1, 10.0.0.10 } accept
        tcp dport { ssh, http, nfs } reject
    }
}

本文链接:http://www.yunweipai.com/35078.html

nft介绍与应用

nft实战-迁移iptables规则到nft

网友评论comments

发表评论

邮箱地址不会被公开。

暂无评论

Copyright © 2012-2021 YUNWEIPAI.COM - 运维派 京ICP备16064699号-6
扫二维码
扫二维码
返回顶部