8.7. 示例：使用 nftables 脚本保护 LAN 和 DMZ

流程

1. 使用以下内容创建 /etc/rsyslog.d/nftables.conf 文件：

   :msg, startswith, "nft drop" -/var/log/nftables.log
   & stop

   Copy to Clipboard Toggle word wrap

   使用这个配置，rsyslog 服务会将丢弃的数据包记录到 /var/log/nftables.log 文件，而不是 /var/log/messages。

2. 重启 rsyslog 服务：

   # systemctl restart rsyslog

   Copy to Clipboard Toggle word wrap

3. 使用以下内容创建 /etc/logrotate.d/nftables 文件，以便在大小超过 10 MB 时轮转 /var/log/nftables.log ：

   /var/log/nftables.log {
     size +10M
     maxage 30
     sharedscripts
     postrotate
       /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
     endscript
   }

   Copy to Clipboard Toggle word wrap

   maxage 30 设置定义了 logrotate 在下一次轮转操作过程中删除超过 30 天的轮转日志。

流程

1. 使用以下内容创建 /etc/nftables/firewall.nft 脚本：

   # Remove all rules
   flush ruleset
   
   
   # Table for both IPv4 and IPv6 rules
   table inet nftables_svc {
   
     # Define variables for the interface name
     define INET_DEV = enp1s0
     define LAN_DEV  = enp7s0
     define DMZ_DEV  = enp8s0
   
   
     # Set with the IPv4 addresses of admin PCs
     set admin_pc_ipv4 {
       type ipv4_addr
       elements = { 10.0.0.100, 10.0.0.200 }
     }
   
   
     # Chain for incoming trafic. Default policy: drop
     chain INPUT {
       type filter hook input priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept incoming traffic on loopback interface
       iifname lo accept
   
       # Allow request from LAN and DMZ to local DNS server
       iifname { $LAN_DEV, $DMZ_DEV } meta l4proto { tcp, udp } th dport 53 accept
   
       # Allow admins PCs to access the router using SSH
       iifname $LAN_DEV ip saddr @admin_pc_ipv4 tcp dport 22 accept
   
       # Last action: Log blocked packets
       # (packets that were not accepted in previous rules in this chain)
       log prefix "nft drop IN : "
     }
   
   
     # Chain for outgoing traffic. Default policy: drop
     chain OUTPUT {
       type filter hook output priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept outgoing traffic on loopback interface
       oifname lo accept
   
       # Allow local DNS server to recursively resolve queries
       oifname $INET_DEV meta l4proto { tcp, udp } th dport 53 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop OUT: "
     }
   
   
     # Chain for forwarding traffic. Default policy: drop
     chain FORWARD {
       type filter hook forward priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # IPv4 access from LAN and internet to the HTTPS server in the DMZ
       iifname { $LAN_DEV, $INET_DEV } oifname $DMZ_DEV ip daddr 198.51.100.5 tcp dport 443 accept
   
       # IPv6 access from internet to the HTTPS server in the DMZ
       iifname $INET_DEV oifname $DMZ_DEV ip6 daddr 2001:db8:b::5 tcp dport 443 accept
   
       # Access from LAN and DMZ to HTTPS servers on the internet
       iifname { $LAN_DEV, $DMZ_DEV } oifname $INET_DEV tcp dport 443 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop FWD: "
     }
   
   
     # Postrouting chain to handle SNAT
     chain postrouting {
       type nat hook postrouting priority srcnat; policy accept;
   
       # SNAT for IPv4 traffic from LAN to internet
       iifname $LAN_DEV oifname $INET_DEV snat ip to 203.0.113.1
     }
   }

   Copy to Clipboard Toggle word wrap

2. 在 /etc/sysconfig/nftables.conf 文件中包括 /etc/nftables/firewall.nft 脚本：

   include "/etc/nftables/firewall.nft"

   Copy to Clipboard Toggle word wrap

3. 启用 IPv4 转发：

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

4. 启用并启动 nftables 服务：

   # systemctl enable --now nftables

   Copy to Clipboard Toggle word wrap

验证

1. 可选：验证 nftables 规则集：

   # nft list ruleset
   ...

   Copy to Clipboard Toggle word wrap

2. 尝试执行防火墙阻止的访问。例如，尝试使用 SSH 从 DMZ 访问路由器：

   # ssh router.example.com
   ssh: connect to host router.example.com port 22: Network is unreachable

   Copy to Clipboard Toggle word wrap

3. 根据您的日志记录设置，搜索：

   • 阻塞的数据包的 systemd 日志：

     # journalctl -k -g "nft drop"
     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

     Copy to Clipboard Toggle word wrap

   • 阻塞的数据包的 /var/log/nftables.log 文件：

     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

     Copy to Clipboard Toggle word wrap