[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6},"actionData","errors","routes/tags.$tag",{"_7":8,"_9":10,"_11":12},"tag","nftables","docs",[13],"count",1,{"_14":15,"_16":17,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27},"slug","replace-iptables-with-nftables","title","使用 nftables 替代 iptables","date","2023-11-12","description","配置 nftables 实现透明代理和 NAT","content","

nftables 是 Linux 新一代的防火墙框架，取代了 iptables，提供更简洁的配置语法和更好的性能。

启用 IP 转发

编辑 /etc/sysctl.conf：

net.ipv4.ip_forward=1\nnet.ipv6.conf.all.forwarding=1\n

安装 nftables

apt install nftables\n\n# 创建配置目录\nmkdir /etc/nftables.conf.d\n

定义私有地址列表

创建 /etc/nftables.conf.d/private.nft：

define private_list = {\n    0.0.0.0/8,\n    10.0.0.0/8,\n    127.0.0.0/8,\n    169.254.0.0/16,\n    172.16.0.0/12,\n    192.168.0.0/16,\n    224.0.0.0/4,\n    240.0.0.0/4\n}\n

这些地址不应走代理，包含本地网络、私有网络和保留地址。

主配置文件

创建 /etc/nftables.conf：

#!/usr/sbin/nft -f\n\nflush ruleset\n\ninclude \"/etc/nftables.conf.d/private.nft\"\n\ntable ip nat {\n    chain proxy {\n        ip daddr $private_list return\n        ip protocol tcp redirect to :7892\n    }\n    chain prerouting {\n        type nat hook prerouting priority 0; policy accept;\n        jump proxy\n    }\n}\n

配置说明：

flush ruleset: 清空现有规则
table ip nat: 创建 NAT 表
chain prerouting: PREROUTING 钩子，处理进入的流量
redirect to :7892: 将流量重定向到本地代理端口

应用规则

# 应用配置\nnft -f /etc/nftables.conf\n\n# 查看规则\nnft list ruleset\n\n# 设置开机自动加载\nsystemctl enable nftables\nsystemctl start nftables\n

与 iptables 的对比

nftables 语法更统一，规则可以原子性更新，支持更灵活的表达式。iptables 规则可以通过 iptables-translate 工具转换为 nftables 语法：

iptables-translate -t nat -A PREROUTING -p tcp -j REDIRECT --to-port 7892\n

","toc",[30,31,32,33,34,35],"tags",[28,8,29],"linux","firewall",{"_36":54,"_38":55,"_40":41,"_42":56},{"_36":51,"_38":52,"_40":41,"_42":53},{"_36":44,"_38":49,"_40":41,"_42":50},{"_36":44,"_38":47,"_40":41,"_42":48},{"_36":44,"_38":45,"_40":41,"_42":46},{"_36":37,"_38":39,"_40":41,"_42":43},"id","-iptables-","text","与 iptables 的对比","depth",2,"children",[],"","应用规则",[],"主配置文件",[],"定义私有地址列表",[],"-nftables","安装 nftables",[],"-ip-","启用 IP 转发",[]]