Вопрос Не получается настроить NFtables на своей VDS

Art_Farm

Пользователь
Сообщения
188
Решения
3
Веб-сайт
artfarm.mine-farm.ru
Хотел настроить nftables для доп защиты своей vds, вот конфиг /etc/nftables.conf:
Код:
table inet filter {
    chain prerouting {
        type filter hook prerouting priority -150; policy accept;
        tcp option maxseg size set rt mtu
    }

    chain input {
        type filter hook input priority 0; policy drop;
        ip saddr 127.0.0.0/8 accept
        ip6 saddr ::1/128 accept
        ct state invalid drop
        ct state established,related accept
        tcp dport 22 ct state new,established accept
        ip protocol icmp icmp type echo-request accept
        icmpv6 type echo-request accept
        meta length > 1500 drop
        log prefix "INPUT_DROP: " limit rate 10/minute
        counter
        drop
    }
}

Вроде всё верно, да и модули я все установил.
Но при вводе «nft -c -f /etc/nftables.conf» ошибка:

Код:
/etc/nftables.conf:4:9-41: Error: Could not process rule: Operation not supported
        tcp option maxseg size set rt mtu
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:11:9-35: Error: Could not process rule: Operation not supported
        ip saddr 127.0.0.0/8 accept
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:12:9-32: Error: Could not process rule: Operation not supported
        ip6 saddr ::1/128 accept
        ^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:15:9-29: Error: Could not process rule: Operation not supported
        ct state invalid drop
        ^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:16:9-43: Error: Could not process rule: Operation not supported
        ct state established,related accept
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:19:9-52: Error: Could not process rule: Operation not supported
        tcp dport 22 ct state new,established accept
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:25:9-54: Error: Could not process rule: Operation not supported
        ip protocol icmp icmp type echo-request accept
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:26:9-39: Error: Could not process rule: Operation not supported
        icmpv6 type echo-request accept
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:29:9-31: Error: Could not process rule: Operation not supported
        meta length > 1500 drop
        ^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:32:9-54: Error: Could not process rule: Operation not supported
        log prefix "INPUT_DROP: " limit rate 10/minute
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/nftables.conf:33:9-15: Error: Could not process rule: Operation not supported
        counter
        ^^^^^^^
/etc/nftables.conf:34:9-12: Error: Could not process rule: Operation not supported
        drop
        ^^^^

Кто поможет? Дайте инструкцию по корректной настройке.
Ядро Linux а oc ubuntu
 
Последнее редактирование:
Назад
Сверху Снизу