8.7. 예제: nftables 스크립트를 사용하여 LAN 및 DMZ 보호

프로세스

1. 다음 콘텐츠를 사용하여 /etc/rsyslog.d/nftables.conf 파일을 생성합니다.

   :msg, startswith, "nft drop" -/var/log/nftables.log
   & stop

   Copy to Clipboard Toggle word wrap

   이 구성을 사용하여 rsyslog 서비스는 /var/log/messages 대신 /var/log/nftables.log 파일에 패킷을 기록합니다.

2. rsyslog 서비스를 다시 시작하십시오.

   # systemctl restart rsyslog

   Copy to Clipboard Toggle word wrap

3. 크기가 10MB를 초과하면 /etc/logrotate.d/nftables 파일을 다음 내용으로 생성하여 /var/log/nftables.log 를 순환합니다.

   /var/log/nftables.log {
     size +10M
     maxage 30
     sharedscripts
     postrotate
       /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
     endscript
   }

   Copy to Clipboard Toggle word wrap

   maxage 30 설정은 logrotate 가 다음 순환 작업 중에 30일이 지난 순환 로그를 제거하도록 정의합니다.

프로세스

1. 다음 콘텐츠를 사용하여 /etc/nftables/firewall.nft 스크립트를 생성합니다.

   # Remove all rules
   flush ruleset
   
   
   # Table for both IPv4 and IPv6 rules
   table inet nftables_svc {
   
     # Define variables for the interface name
     define INET_DEV = enp1s0
     define LAN_DEV  = enp7s0
     define DMZ_DEV  = enp8s0
   
   
     # Set with the IPv4 addresses of admin PCs
     set admin_pc_ipv4 {
       type ipv4_addr
       elements = { 10.0.0.100, 10.0.0.200 }
     }
   
   
     # Chain for incoming trafic. Default policy: drop
     chain INPUT {
       type filter hook input priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept incoming traffic on loopback interface
       iifname lo accept
   
       # Allow request from LAN and DMZ to local DNS server
       iifname { $LAN_DEV, $DMZ_DEV } meta l4proto { tcp, udp } th dport 53 accept
   
       # Allow admins PCs to access the router using SSH
       iifname $LAN_DEV ip saddr @admin_pc_ipv4 tcp dport 22 accept
   
       # Last action: Log blocked packets
       # (packets that were not accepted in previous rules in this chain)
       log prefix "nft drop IN : "
     }
   
   
     # Chain for outgoing traffic. Default policy: drop
     chain OUTPUT {
       type filter hook output priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept outgoing traffic on loopback interface
       oifname lo accept
   
       # Allow local DNS server to recursively resolve queries
       oifname $INET_DEV meta l4proto { tcp, udp } th dport 53 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop OUT: "
     }
   
   
     # Chain for forwarding traffic. Default policy: drop
     chain FORWARD {
       type filter hook forward priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # IPv4 access from LAN and internet to the HTTPS server in the DMZ
       iifname { $LAN_DEV, $INET_DEV } oifname $DMZ_DEV ip daddr 198.51.100.5 tcp dport 443 accept
   
       # IPv6 access from internet to the HTTPS server in the DMZ
       iifname $INET_DEV oifname $DMZ_DEV ip6 daddr 2001:db8:b::5 tcp dport 443 accept
   
       # Access from LAN and DMZ to HTTPS servers on the internet
       iifname { $LAN_DEV, $DMZ_DEV } oifname $INET_DEV tcp dport 443 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop FWD: "
     }
   
   
     # Postrouting chain to handle SNAT
     chain postrouting {
       type nat hook postrouting priority srcnat; policy accept;
   
       # SNAT for IPv4 traffic from LAN to internet
       iifname $LAN_DEV oifname $INET_DEV snat ip to 203.0.113.1
     }
   }

   Copy to Clipboard Toggle word wrap

2. /etc/sysconfig/nftables.conf 파일에 /etc/nftables/firewall.nft 스크립트를 포함합니다.

   include "/etc/nftables/firewall.nft"

   Copy to Clipboard Toggle word wrap

3. IPv4 전달을 활성화합니다.

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

4. nftables 서비스를 활성화하고 시작합니다.

   # systemctl enable --now nftables

   Copy to Clipboard Toggle word wrap

검증

1. 선택 사항: nftables 규칙 세트를 확인합니다.

   # nft list ruleset
   ...

   Copy to Clipboard Toggle word wrap

2. 방화벽에서 금지하는 액세스를 수행합니다. 예를 들어 DMZ에서 SSH를 사용하여 라우터에 액세스하려고 합니다.

   # ssh router.example.com
   ssh: connect to host router.example.com port 22: Network is unreachable

   Copy to Clipboard Toggle word wrap

3. 로깅 설정에 따라 다음을 검색합니다.

   • 차단된 패킷의 systemd 저널:

     # journalctl -k -g "nft drop"
     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

     Copy to Clipboard Toggle word wrap

   • 차단된 패킷의 /var/log/nftables.log 파일입니다.

     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

     Copy to Clipboard Toggle word wrap