nft

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

nftables replaced iptables. firewalld writes its rules into nftables (table inet firewalld). With nft list ruleset you see what the kernel really does. On systems with firewalld, use firewall-cmd for changes; write nft rules yourself only on systems without firewalld (then use nftables.service and /etc/sysconfig/nftables.conf).

طريقة الكتابة

nft [OPTION]... COMMAND
nft -f FILE

الأجزاء الرئيسية

list ruleset: Show all rules.
list tables / list table FAMILY NAME: Tables.
list chain FAMILY TABLE CHAIN: One chain.
add table, add chain, add rule: Create.
insert rule, replace rule, delete rule handle N: Change rules.
add set, add element: Address or port sets.
flush ruleset: Remove all rules (dangerous).
monitor: Watch rule changes and traces.
FAMILY: ip, ip6, inet (both), arp, bridge, netdev.

الخيارات 18

الأكثر استخدامًا

-a, --handle: Show rule handles (needed to delete a rule).
-f, --file FILE: Read commands from a file.
-c, --check: Check the commands, do not apply.
-n, --numeric: Numbers instead of names (addresses, ports).
-N, --reversedns: Resolve IPs to names.
-S, --service: Port numbers as service names.
-s, --stateless: Leave out counters and state.
-t, --terse: Leave out set contents.
-j, --json: JSON output.
-e, --echo: Print what was added.
-i, --interactive: Interactive mode.
-D, --define NAME=VALUE: Define a variable for files.
-I, --includepath DIR: Folder for include files.
-o, --optimize: Optimize the rules.
-y, --numeric-priority, -p, --numeric-protocol, -T, --numeric-time, -u, --guid: More numeric output.
-d, --debug LEVEL: Debug output.
-h, --help: Show help.
-v, --version: Show the version.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1All rules
```
#nft list ruleset | less
```
Includes the rules firewalld made.
2Tables
```
#nft list tables
table inet firewalld
```
firewalld's table.
3firewalld zone rules
```
#nft list chain inet firewalld filter_IN_public_allow
```
The services of the public zone as rules.
4Rules with handles
```
#nft -a list ruleset | grep handle | head
```
Handles identify single rules.
5Check a rules file
```
#nft -c -f /etc/sysconfig/nftables.conf
```
Syntax check before loading.

6A simple firewall without firewalld

#nft add table inet filter
#nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
#nft add rule inet filter input ct state established,related accept
#nft add rule inet filter input iif lo accept
#nft add rule inet filter input tcp dport 22 accept

Only on systems where firewalld is off.

7Block a list of attackers with a set

#nft add set inet filter blocklist '{ type ipv4_addr; }'
#nft add element inet filter blocklist '{ 203.0.113.50 }'
#nft add rule inet filter input ip saddr @blocklist drop

Sets scale to many addresses.

8Save the current rules
```
#nft list ruleset > /etc/sysconfig/nftables.conf
```
Loaded by nftables.service at boot.
9Watch rule changes
```
#nft monitor
```
Shows changes live (for example from firewall-cmd).

10JSON for tools

#nft -j list ruleset | jq '.nftables | length'

Machine-readable.

انتبه

Do not change firewalld's tables by hand; a reload overwrites them.
flush ruleset with a drop policy can cut your SSH session.

الملفات

/etc/sysconfig/nftables.conf: Rules for nftables.service.
/etc/nftables/: Example rule files.

رموز الخروج

`0`	Done.
`1`	Error.

`nft`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

الخيارات 18

أمثلة 10

1All rules

2Tables

3firewalld zone rules

4Rules with handles

5Check a rules file

6A simple firewall without firewalld

7Block a list of attackers with a set

8Save the current rules

9Watch rule changes

10JSON for tools

انتبه

الملفات

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

الخيارات 18

أمثلة 10

1All rules

2Tables

3firewalld zone rules

4Rules with handles

5Check a rules file

6A simple firewall without firewalld

7Block a list of attackers with a set

8Save the current rules

9Watch rule changes

10JSON for tools

انتبه

الملفات

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`nft`