[B! iptables] n2sã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

n2s id:n2s

iptablesã«é–¢ã™ã‚‹n2sã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (32)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

netfilterã¨firewalldã¨iptablesã¨nftablesã®é–¢ä¿‚ - Qiita
ã¯ã˜ã‚ã« netfilterã«ã¤ã„ã¦å°‘ã—èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚ ã„ã‚ã„ã‚ã¨èªè˜ã®ç›¸é•ãŒã‚ã£ãŸã“ã¨ãŒã‚ã‹ã£ãŸã®ã§ã€è¨˜éŒ²ã—ã¾ã™ã€‚ èªè˜ã®ç›¸é• CentOS8ï¼ˆã«é™ã‚‰ãšã ã‘ã©ï¼‰ã§ã¯ã€ä»¥ä¸‹ã®ã“ã¨ãŒã‚ã‹ã£ãŸã€‚ iptablesã¯iptablesã§ã¯ãªãnftablesã§ã‚ã‚‹ firewall-cmdã§è¨å®šã—ãŸãƒ«ãƒ¼ãƒ«ã¯iptablesã§ã¯è¡¨ç¤ºã•ã‚Œãªã„ ã™ã¹ã¦ã®ãƒ«ãƒ¼ãƒ«ç¢ºèªã¯nftã‚’ä½¿ã† Linuxã§ã®ãƒ‘ã‚±ãƒƒãƒˆã®æµã‚Œã«ã¤ã„ã¦ netfilter netfilterã¯Linuxã§ãƒ‘ã‚±ãƒƒãƒˆã®å‡¦ç†ã‚’ã™ã‚‹åŸºæœ¬ãƒ«ãƒ¼ãƒ« ã‚¤ãƒ³ã‚¿ãƒ•ã‚§ã‚¤ã‚¹ã§å—ä¿¡ã—ãŸãƒ‘ã‚±ãƒƒãƒˆãŒã©ã‚“ãªå‡¦ç†ã‚’ã•ã‚Œã¦ã„ãã‹ã€ã¨ã„ã†ã‚„ã¤ã§ã™ã€‚ netfilter.orgã«ã‚ˆã‚‹ã¨ã€ netfilterã¯ã€ã‚«ãƒ¼ãƒãƒ«ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãŒãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¹ã‚¿ãƒƒã‚¯ã«ã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã‚’ç™»éŒ²ã§ãã‚‹ã‚ˆã†ã«ã™ã‚‹Linuxã‚«ãƒ¼ãƒãƒ«å†…ã®ä¸€é€£ã®ãƒ•ãƒƒã‚¯ã§ã™ã€‚ç™»éŒ²ã•ã‚ŒãŸã‚³ãƒ¼ãƒ«ãƒãƒƒã‚¯é–¢æ•°ã¯ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¹ã‚¿ãƒƒã‚¯
n2s 2020/05/11
Linux

iptables

firewalld

nftables

!è¦ãƒã‚§ãƒƒã‚¯
ãƒªãƒ³ã‚¯
Linuxã«ãŠã‘ã‚‹æ–°ãŸãªãƒ‘ã‚±ãƒƒãƒˆãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ãƒ„ãƒ¼ãƒ«ã€Œnftablesã€å…¥é–€ | ã•ãã‚‰ã®ãƒŠãƒ¬ãƒƒã‚¸
ãŸã¨ãˆã°ã€ã‹ã¤ã¦iptablesã§è¨å®šã—ã¦ã„ãŸIPv4ã«é–¢é€£ã™ã‚‹ãƒ‘ã‚±ãƒƒãƒˆãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°è¨å®šã¯ã€nftablesã«ãŠã„ã¦ã¯ã€Œipã€ã¨ã„ã†ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒ•ã‚¡ãƒŸãƒªã«ç´ä»˜ã‘ãŸãƒ†ãƒ¼ãƒ–ãƒ«ã‚’ä½œæˆã™ã‚‹ã“ã¨ã§è¨å®šã§ãã‚‹ã€‚åŒæ§˜ã«ã€ip6tablesã‚„arpta blesã€ebtablesã§è¨å®šã—ã¦ã„ãŸã‚‚ã®ã¯ãã‚Œãžã‚Œã€Œip6ã€ã‚„ã€Œarpã€ã€ã€Œbridgeã€ã¨ã„ã†ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒ•ã‚¡ãƒŸãƒªã«ç´ä»˜ã‘ãŸãƒ†ãƒ¼ãƒ–ãƒ«ã§è¨å®šã™ã‚‹ã€‚ ã€Œinetã€ã€ŒãŠã‚ˆã³ã€Œnetdevã€ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒ•ã‚¡ãƒŸãƒªã¯nftablesã§æ–°ãŸã«å°Žå…¥ã•ã‚ŒãŸã‚‚ã®ã§ã€ã¾ãšã€Œinetã€ã¯IPv4ãŠã‚ˆã³IPv6ã®ä¸¡æ–¹ã‚’å¯¾è±¡ã«ã—ãŸè¨å®šã‚’è¡Œãˆã‚‹ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒ•ã‚¡ãƒŸãƒªã ã€‚å¾“æ¥IPv4ã¨IPv6ã®ä¸¡æ–¹ã«ã¾ãŸãŒã£ãŸãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ãƒ«ãƒ¼ãƒ«ã‚’è¨å®šã—ãŸã„å ´åˆã¯iptablesã¨ip6tablesã®ä¸¡æ–¹ã§åŒã˜ã‚ˆã†ãªãƒ«ãƒ¼ãƒ«ã‚’è¿½åŠ ã™ã‚‹å¿…è¦ãŒã‚ã£ãŸãŒã€nftablesã§ã¯inetã‚¢ãƒ‰ãƒ¬ã‚¹ãƒ•ã‚¡ãƒŸãƒªã§æŒ‡å®šã™ã‚‹ã“ã¨ã§å˜ä¸€ã®è¨
n2s 2019/09/11
Linux

nftables

iptables

!è¦ãƒã‚§ãƒƒã‚¯
ãƒªãƒ³ã‚¯
iptablesã®å¾Œã«æ¥ã‚‹ã‚‚ã®ã¯ä½•ã‹ï¼Ÿï¼š nftables - èµ¤å¸½ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒ–ãƒã‚°
ã“ã®è¨˜äº‹ã¯Red Hat Developerã®What comes after â€˜iptablesâ€™? Its successor, of course: nftablesã‚’ã€è¨±å¯ã‚’ã†ã‘ã¦ç¿»è¨³ã—ãŸã‚‚ã®ã§ã™ã€‚ ::: By Florian Westphal October 28, 2016 ::: ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹ï¼š ãƒ¦ãƒ¼ã‚¶ãƒ“ãƒªãƒ†ã‚£ï¼š nftablesã¨ã¯ä½•ã§ã™ã‹ï¼Ÿ ä½•ãŒç½®ãæ›ãˆã‚‰ã‚Œã¾ã™ã‹ï¼Ÿ ãªãœiptablesã‚’ç½®ãæ›ãˆã‚‹ã®ã‹ï¼Ÿ nftablesã§ã®é«˜æ°´æº–ãªæ©Ÿèƒ½ åˆ¤æ–ãƒžãƒƒãƒ—ï¼ˆã‚¸ãƒ£ãƒ³ãƒ—ãƒ†ãƒ¼ãƒ–ãƒ«ï¼‰ flowæ–‡ inetãƒ•ã‚¡ãƒŸãƒªãƒ¼ ã¯ã˜ã‚ã‚‹ ãƒã‚§ãƒ¼ãƒ³ã®è¿½åŠ NAT æ—¢çŸ¥ã®åˆ¶é™ é–¢é€£è¨˜äº‹ nftablesã¯ã€æ—¢å˜ã®iptablesã€ip6tablesã€arpta blesã€ebtablesã‚’ç½®ãæ›ãˆã‚‹ã“ã¨ã‚’ç›®æŒ‡ã—ãŸã€æ–°ãŸãªãƒ‘ã‚±ãƒƒãƒˆåˆ†é¡žãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã§ã™ã€‚ã“ã‚Œã¯ã€é•·ãä½¿ã‚ã‚Œã¦ããŸ ip/ip6table
n2s 2019/07/31
firewalldã¯nftãƒãƒƒã‚¯ã‚¨ãƒ³ãƒ‰å¯¾å¿œãŒé€²ã‚“ã§ã„ã‚‹ãã†ã§(ã‹ãŸã‚„ufwâ€¦)

nftables

iptables
ãƒªãƒ³ã‚¯
ã•ãã‚‰ã®VPS x LXC x IPv6 - The Weight
ã“ã‚“ã«ã¡ã¯ã€‚ ã•ãã‚‰ã®VPSã§ä½¿ãˆã¦ã„ãŸ6rdãƒˆãƒ©ã‚¤ã‚¢ãƒ«ãŒ3/31ã§çµ‚ã‚ã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ ã¨ã“ã‚ã§ã€ã ã„ã¶å‰ã‹ã‚‰ã•ãã‚‰ã®VPSã§ã¯ãƒã‚¤ãƒ†ã‚£ãƒ–ãªIPv6ã‚¢ãƒ‰ãƒ¬ã‚¹ãŒé…å¸ƒã•ã‚Œã€åˆ©ç”¨ã§ãã¦ã„ã¾ã—ãŸã€‚(ã€Œã•ãã‚‰ã®VPSã€å¤§é˜ªãƒªãƒ¼ã‚¸ãƒ§ãƒ³ IPv6ã‚¢ãƒ‰ãƒ¬ã‚¹æä¾›é–‹å§‹ã®ãŠçŸ¥ã‚‰ã›) ã—ã‹ã—ãªãŒã‚‰ã€é…å¸ƒã•ã‚Œã¦ã„ã‚‹ã‚¢ãƒ‰ãƒ¬ã‚¹ã¯1å€‹ã®ã¿ã§ä½¿ã„å‹æ‰‹ãŒã‚ˆããªãã€ãã‚ŒãŒ6rdã‚’æœ€å¾Œã¾ã§ä½¿ã£ã¦ã„ãŸç†ç”±ã§ã‚‚ã‚ã‚Šã¾ã—ãŸã€‚ ã¾ãã‚µãƒ¼ãƒ“ã‚¹ãŒçµ‚ã‚ã£ã¦ã—ã¾ã£ãŸã®ãªã‚‰ç§»è¡Œã›ã–ã‚‹ã‚’å¾—ãªã„ã¨ã„ã†ã“ã¨ã§é‡ã„è…°ã‚’ä¸Šã’ã¦ä½œæ¥ã—ãŸæ¬¡ç¬¬ã§ã™ã€‚ ã•ãã‚‰VPSã®IPv6 å‰è¿°ã®é€šã‚Šã€ç¾åœ¨ã•ãã‚‰VPSã§ä½¿ãˆã‚‹IPv6ã¯ãƒã‚¤ãƒ†ã‚£ãƒ–æŽ¥ç¶šã«ãªã£ã¦ã„ã¾ã™ã€‚ å˜ç´”ã«VPSã§IPv6ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’ä½¿ã†ã ã‘ãªã‚‰ä»¥ä¸‹ã®è¨å®šã ã‘ã§ååˆ†ã§ã™ã€‚ /etc/network/interfaces1 2 3 4 iface eth0 inet6 static address 2403:3
n2s 2019/07/21
IPv6

NAT

iptables

ã•ãã‚‰ã®VPS
ãƒªãƒ³ã‚¯
ã‚ãªãŸãŒnftablesã‚’å¥½ãã«ãªã‚‹ã‚ã‘ | Yakst
Linux Kernel 3.13ã‹ã‚‰ã€ãƒ‘ã‚±ãƒƒãƒˆãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ã‚„NATãªã©ã‚’ç®¡ç†ã™ã‚‹ãƒ„ãƒ¼ãƒ«ã§ã‚ã‚‹iptablesã«ä»£ã‚ã£ã¦ã€nftablesãŒæŽ¡ç”¨ã•ã‚Œã¦ã„ã‚‹ã€‚ã“ã®nftablesã«é–¢ã—ã¦ã€iptablesã«å¯¾ã™ã‚‹åˆ©ç‚¹ã‚„ã€ã‚³ãƒžãƒ³ãƒ‰æ“ä½œã®é•ã„ã«ã¤ã„ã¦ç°¡å˜ã«è§£èª¬ã™ã‚‹ã€‚ Linux 3.13ç™»å ´ Linux 3.13ã¯ä½•ã‚ˆã‚Šã€nftablesã®æœ€åˆã®ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ãƒªãƒªãƒ¼ã‚¹ã§ã‚ã‚‹ã€‚nfstablesã¯ã€æ—¢å˜ã®iptablesã§çŸ¥ã‚‰ã‚Œã‚‹{ip, ip6, arp, eb}tablesãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚’ç½®ãæ›ãˆã‚‹ç›®çš„ã‚’æŒã£ãŸãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã ã€‚Linux 3.13ã«å«ã¾ã‚Œã‚‹nftablesã¯ã¾ã å®Œå…¨ã§ã¯ãªãã€ã„ãã¤ã‹ã®é‡è¦ãªæ©Ÿèƒ½ãŒä¸è¶³ã—ã¦ã„ã‚‹ãŒã€ä»Šå¾Œã®Linuxãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ç™»å ´ã—ã¦ãã‚‹ã ã‚ã†ã€‚æ—¢ã«å¤šãã®ã‚±ãƒ¼ã‚¹ã§ã¯ä½¿ã„ç‰©ã«ãªã‚‹ã‚‚ã®ã ãŒã€å®Œå…¨ãªã‚µãƒãƒ¼ãƒˆ(nftablesãŒiptablesã‚ˆã‚Šã‚‚é«˜ã„ãƒ¬ãƒ™ãƒ«ã«é”ã™ã‚‹ã¨ã„
n2s 2018/07/10
Linux

iptables

nftables
ãƒªãƒ³ã‚¯
How to drop 10 million packets per second
Internally our DDoS mitigation team is sometimes called "the packet droppers". When other teams build exciting products to do smart things with the traffic that passes through our network, we take joy in discovering novel ways of discarding it. CC BY-SA 2.0 image by Brian Evans Being able to quickly discard packets is very important to withstand DDoS attacks. Dropping packets hitting our servers,
n2s 2018/07/09
iptables
ãƒªãƒ³ã‚¯
GeoIPã‚’ä½¿ã£ã¦å›½åˆ¥ã«iptablesã§æŽ¥ç¶šåˆ¶å¾¡ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
n2s 2018/05/26
2014å¹´ã®è¨˜äº‹ã€‚debianãªã‚‰xtables-addons-commonãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã‚ã‚Š

iptables

geoip
ãƒªãƒ³ã‚¯
Linux iproute2ã§conntrackãƒ¬ã‚¹ãªStateless NAT | DevelopersIO
ã©ã‚‚ã€å¤§ç€§ã§ã™ã€‚ Linuxã§é™çš„NATã‚’çµ„ã‚€ã¨ãã®å®šç•ªã¯Netfilter(iptables)ã§ã™ãŒã€iptablesã®natãƒ†ãƒ¼ãƒ–ãƒ«ã®é‹ç”¨ã«ã¯conntrack(ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³è¿½è·¡ãƒ†ãƒ¼ãƒ–ãƒ«)ã®ã‚µã‚¤ã‚¸ãƒ³ã‚°ãŒã¤ãã¾ã¨ã„ã¾ã™ã€‚ãã“ã§ä»Šå›žã¯é™çš„NATã‚’çµ„ã‚€Linuxã‚«ãƒ¼ãƒãƒ«ã®ã‚‚ã†ã²ã¨ã¤ã®æ©Ÿèƒ½ã¨ã—ã¦ã€iproute2ã«ã‚ˆã‚‹Stateless NATæ§‹æˆã‚’ã”ç´¹ä»‹ã—ã¾ã™ã€‚ å‹•ä½œç¢ºèªç’°å¢ƒ Linuxãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ : Amazon Linux 2.0 RC iproute2ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ : 3.10.0 æ§‹æˆä¾‹ã¨è¨å®šã‚³ãƒžãƒ³ãƒ‰ ä»Šå›žã¯ã‚ã‚ŠãŒã¡ãªé™çš„NATæ§‹æˆã¨ã—ã¦ã€ä»¥ä¸‹ã§è¨å®šã—ã¦ã¿ã¾ã™ã€‚ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆPCã¯NAT Boxå®›(192.168.1.1)ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’é€å‡ºã€NAT Boxã®é™çš„NATã§Webã‚µãƒ¼ãƒãƒ¼å®›(10.10.0.100)ã«DNATã€æˆ»ã‚Šç”¨ã«SNATã‚‚ãƒšã‚¢ã§è¨å®šã™ã‚‹æ„Ÿã˜ã§ã™ãã€‚ipt
n2s 2018/01/30
Linux

NAT

iproute2

iptables
ãƒªãƒ³ã‚¯
nftables - ArchWiki
nftables ã¯æ—¢å˜ã® ip-, ip6-, arp-, ebtables ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã‚’ç½®ãæ›ãˆã‚‹ netfilter ã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã§ã™ã€‚æ–°ã—ã„ãƒ‘ã‚±ãƒƒãƒˆãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã€æ–°ã—ã„ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¹ãƒšãƒ¼ã‚¹ãƒ¦ãƒ¼ãƒ†ã‚£ãƒªãƒ†ã‚£ (nft)ã€ãã—ã¦ ip- ã¨ ip6tables ã®äº’æ›ãƒ¬ã‚¤ãƒ¤ãƒ¼ã‚’æä¾›ã—ã¾ã™ã€‚ç¾è¡Œã®ãƒ•ãƒƒã‚¯ã€æŽ¥ç¶šè¿½è·¡ã‚·ã‚¹ãƒ†ãƒ ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¹ãƒšãƒ¼ã‚¹ã®ã‚ãƒ¥ãƒ¼ã‚¤ãƒ³ã‚°ã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã€ãã—ã¦ netfilter ã®ãƒã‚°ã‚µãƒ–ã‚·ã‚¹ãƒ†ãƒ ã‚’ä½¿ã£ã¦ã„ã¾ã™ã€‚ nftables ã¯3ã¤ã®ãƒ¡ã‚¤ãƒ³ã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã‹ã‚‰æ§‹æˆã•ã‚Œã¦ã„ã¾ã™: ã‚«ãƒ¼ãƒãƒ«ã®å®Ÿè£…ã€libnl netlink communication ãã—ã¦ nftables ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚¹ãƒšãƒ¼ã‚¹ãƒ•ãƒãƒ³ãƒˆã‚¨ãƒ³ãƒ‰ã€‚ã‚«ãƒ¼ãƒãƒ«ã¯ netlink ã®è¨å®šã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ã‚¤ã‚¹ã ã‘ã§ãªãã€å°ã•ãªã‚¯ãƒ©ã‚¹è¨€èªžã‚¤ãƒ³ã‚¿ãƒ—ãƒªã‚¿ã‚’ä½¿ç”¨ã™ã‚‹ãƒ©ãƒ³ã‚¿ã‚¤ãƒ ã®ãƒ«ãƒ¼ãƒ«ã‚»ãƒƒãƒˆã®è©•ä¾¡ã‚‚æä¾›ã—ã¾ã™ã€‚li
n2s 2016/11/02
Linux

iptables

nftables

!è¦ãƒã‚§ãƒƒã‚¯
ãƒªãƒ³ã‚¯
nftables: the Next Generation Firewall in Linux
Presented in Kernel/VM tankentai vol.11, June 6, 2015. Alternate URL: https://speakerdeck.com/s1061123/nftables-the-next-generation-firewall-in-linux
n2s 2015/06/06
Linux

iptables
ãƒªãƒ³ã‚¯
iptable ã‚’ä½¿ã£ãŸã€ãƒãƒ¼ãƒˆã®å¤‰æ›: ã¨ã‚‚ ã¡ã‚ƒæ—¥è¨˜(Tomo cha) - å…ƒå¤§å¦ç”Ÿã®ï¼¯ï¼¬æ—¥è¨˜-
ã‚ãŸã—ã®æ—¥è¨˜ã¯æ—¥ã€…ã®å‡ºæ¥äº‹ã®é¬±æ†¤æ™´ã‚‰ã—ã®æ¯’ã ã—æ—¥è¨˜ãŒãƒ¡ã‚¤ãƒ³ã§ã™ã€‚ ç›¸å½“ç—…ã‚“ã§ã„ã¾ã™ã€‚ãã ã‚’å·»ã„ã¦ã„ã¾ã™ã€‚è¨±å®¹å‡ºæ¥ã‚‹æ–¹ã®ã¿ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚’ãŠé¡˜ã„ã—ã¾ã™ã€‚ ã¾ãŸã€ã“ã®æ—¥è¨˜ã¸ã®ãƒªãƒ³ã‚¯ã¯åŽŸå‰‡è‡ªç”±ã«ã—ã¦é ‚ã„ã¦ã‚‚çµæ§‹ã§ã™ãŒã€ å†™çœŸã¸ã®ç›´ãƒªãƒ³ã‚¯ã‚’å¼µã‚‹ã®ã¯ã”é æ…®ä¸‹ã•ã„ã€‚å†…å®¹ã«é–¢ã—ã¦ã¯ã€ä¸€åˆ‡ä¿è¨¼è‡´ã—ã¾ã›ã‚“ã€‚ ã‚«ãƒ†ã‚´ãƒªä¸€è¦§ Network, Internet, IPv6, DC, NTT, Comp, Linux, Debian, FreeBSD, Windows, Server, Security, IRC, å¤§å¦, Neta, spam, é£Ÿ, ç”Ÿæ´», éŠã³, Drive, TV, ä»•äº‹, ã¨ã‚ã‚‹ã‚µãƒ¼ãƒã§ã€ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†è€…ãŒãƒãƒ¼ãƒˆã‚’å¤‰æ›´ã—ã¦ãŠã‚Šã€æ—¢å˜ã®ãƒãƒ¼ãƒˆã§ã¯ãªã„ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã‚’æ§‹ç¯‰ã—ã¦ã—ã¾ã„ã€ä¸€éƒ¨ã®ãƒŸãƒ‰ãƒ«ã‚¦ã‚§ã‚¢ã§éžå¸¸ã«ä¸éƒ½åˆãŒå‡ºã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã‚“ã§ã€å¯¾å¿œç–ã‚’è€ƒãˆãŸçµæžœ...ã©ã†ã—ãŸã‹ã¨ã„ã† ã¨ã€‚ã€‚ã€‚ ç’°å¢ƒã¯
n2s 2015/05/20
iptables
ãƒªãƒ³ã‚¯
nftables
n2s 2015/04/24
iptables
ãƒªãƒ³ã‚¯
tcpdumpã¨iptablesã®é–¢ä¿‚ - ï¼ˆã²ï¼‰ãƒ¡ãƒ¢
è¿½è¨˜ 2009-04-03 ã¾ã£ãŸãã‚‚ã£ã¦ãƒ–ã‚³ãƒ¡ã§ã„ãŸã ã„ãŸæŒ‡æ‘˜ã®é€šã‚Šã§ã™ï¼žï¼œ h2onda linux, tcpdump tcpdump(ã¨ã„ã†ã‹libpcap)ã¯ã€ãƒ‡ãƒ¼ã‚¿ãƒªãƒ³ã‚¯å±¤(OSI layer2)ãƒ¬ãƒ™ãƒ«ã§ãƒ‘ã‚±ãƒƒãƒˆã‚’å–å¾—ã™ã‚‹ packet ãƒ—ãƒãƒˆã‚³ãƒ«ã‚’ä½¿ã£ã¦ã‚‹ã®ã§ã€ãã†ãªã‚Šã¾ã™ã€‚å‚ç…§: man packet(7) 2009/04/02 ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ - h2ondaã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ / 2009å¹´4æœˆ2æ—¥ tt_clown network ç´°ã‹ã„ã‘ã©ï¼Œå›³ã¯é€†ï¼ˆNIC ãŒä¸‹ï¼‰ã®ãŒè‰¯ã„ã‹ãªã¨æ€ã£ãŸï¼Ž/ "ip"tables ã¨è¨€ã†ä½ã ã‹ã‚‰ï¼ŒIPå±¤ã§ãƒ‘ã‚±ãƒƒãƒˆã‚’ãƒ•ã‚£ãƒ«ã‚¿ã—ã¦ã‚‹ã¦äº‹ã ã‚ã†ãªï¼Žtcpdumpã¯Ethernet Frameã‚‚è¦‹ãˆã‚‹ã®ã§ï¼Œå¾Œã¯åˆ†ã‹ã‚‹ãªï¼Ÿãƒ»ãƒ»ãƒ»ã¦ã¨ã“ã‹ï¼Ž 2009/04/02 ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ - tt_clownã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ / 2009å¹´4æœˆ2æ—¥ pack
n2s 2015/03/17
2009å¹´ã®è¨˜äº‹

Linux

iptables
ãƒªãƒ³ã‚¯
iptablesã®è¨å®šå†…å®¹ç¢ºèªã¨è¨å®šä¾‹
ã“ã‚Œã‚’å®Ÿè¡Œã™ã‚‹ã¨ç¾çŠ¶ã®ãƒ•ã‚£ãƒ«ã‚¿ãƒªãƒ³ã‚°ãƒ«ãƒ¼ãƒ«ã‚’ç¢ºèªã™ã‚‹ã“ã¨ãŒã§ãã€ä¸‹è¨˜ã®ã‚ˆã†ã«è¡¨ç¤ºã•ã‚Œã‚‹ã¨æ€ã„ã¾ã™ã€‚(ä¸‹è¨˜ã®è¡¨ç¤ºçµæžœã¯ubuntu12.04ã®å ´åˆã§ã™) Chain INPUT (policy ACCEPT 0 packets, 0 bytes) target port opt source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) target port opt source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) target port opt source destination
n2s 2015/03/09
iptables

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
iptablesã§ç‰¹å®šãƒ¦ãƒ¼ã‚¶ä»¥å¤–ã®SMTPé€šä¿¡ã‚’ãƒ–ãƒãƒƒã‚¯ã—ã€SPAMã®è¸ã¿å°ã«ãªã‚‹ã®ã‚’é˜²ãæ–¹æ³•
iptablesã§ç‰¹å®šãƒ¦ãƒ¼ã‚¶ä»¥å¤–ã®SMTPé€šä¿¡ã‚’ãƒ–ãƒãƒƒã‚¯ã—ã€SPAMã®è¸ã¿å°ã«ãªã‚‹ã®ã‚’é˜²ãæ–¹æ³• 2015/1/6 2015/1/6 CentOS, ã‚µãƒ¼ãƒç®¡ç†, ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ ã‚µãƒ¼ãƒã«ä¾µå…¥ã•ã‚Œã¦ã—ã¾ã£ãŸæ™‚ã€éžå¸¸ã«ã‚ˆãã‚ã‚‹ã®ãŒã€ŒSPAMã®è¸ã¿å°ã«ã•ã‚Œã‚‹ã€ã“ã¨ã§ã™ã€‚ é‹è‰¯ã(é‹æ‚ªã?)SPAMã‚’ãƒãƒ©æ’’ã„ã¦ã„ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ç™ºè¦‹å‡ºæ¥ã‚Œã°ã„ã„ã®ã§ã™ãŒã€ã€ŒSPAMã®è¸ã¿å°ã«ã•ã‚Œã¦ã„ã‚‹ç–‘ã„ãŒã‚ã‚‹ 1ãŒã€ãã®ãƒ—ãƒã‚°ãƒ©ãƒ ã¯ç‰¹å®šå‡ºæ¥ãªã„ã€ã¨ã„ã†ã®ãŒä¸€ç•ªå«Œãªã‚±ãƒ¼ã‚¹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ ãªãœã“ã®ã‚ˆã†ãªã“ã¨ãŒèµ·ã“ã‚‹ã®ã‹ã¨è¨€ã†ã¨ã€æ¬¡ã®ã‚ˆã†ãª2ã¤ã®å•é¡ŒãŒã‚ã‚‹ã‹ã‚‰ã§ã™ã€‚ 1. ã™ã¹ã¦ã®ãƒ¦ãƒ¼ã‚¶ãŒå¤–éƒ¨ã®TCP 25ç•ªãƒãƒ¼ãƒˆã«é€šä¿¡å‡ºæ¥ã¦ã—ã¾ã†ã€‚ 2. ãƒ¦ãƒ¼ã‚¶ãŒå¤–éƒ¨ã¨é€šä¿¡ã—ãŸæ™‚ã®ãƒã‚°ãŒæ®‹ã‚‰ãªã„ã€‚ ã“ã®2ç‚¹ã‚’è§£æ±ºã™ã‚Œã°ã€ 1. Postfixã‚„Sendmailãªã©ã®ã€é™ã‚‰ã‚ŒãŸMTAã®ã¿ãŒå¤–éƒ¨ã®TCP 25ç•ªãƒãƒ¼ãƒˆã¨é€šä¿¡å‡ºæ¥ã‚‹ã€‚MTAçµŒ
n2s 2015/01/06
iptables

SMTP
ãƒªãƒ³ã‚¯
ã•ãã‚‰ã®VPSã§ãƒ•ã‚¡ã‚¤ã‚¢ãƒ¼ã‚¦ã‚©ãƒ¼ãƒ«ãŒä½•ã‚‚è¨å®šã•ã‚Œã¦ã„ãªã„ã®ã«é©šæ„•ã—ãŸãŒ ufw ã§è§£æ±º - babie, you're my home
ã•ãã‚‰ã®VPS ã£ã¦ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã¯ãƒ•ã‚¡ã‚¤ã‚¢ãƒ¼ã‚¦ã‚©ãƒ¼ãƒ«ã®è¨å®šä½•ã‚‚ã•ã‚Œã¦ãªã„ã¨ã„ã†è¨˜äº‹ã‚’ã¿ã¦é©šæ„•ã—ãŸã€‚ã¨ã€ã‚ˆãè€ƒãˆãŸã‚‰ Ubuntu 10.04 LTS ã‚’å†ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ãŸã‹ã‚‰ã€ã©ã£ã¡ã«ã—ã¦ã‚‚åˆæœŸçŠ¶æ…‹ã ãªã€‚ ã¨ã‚Šã‚ãˆãšç¢ºã‹ã‚ãŸã€‚ $ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ã‚ªã‚¦ãƒ•ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã¯ç©ºãªã®ã‹â€¦â€¦ iptables ã®è¨å®šã‚ã‚“ã©ãã›ã‡ãªãƒ¼ã©ã†ã—ã‚ˆã†ã‹ãªãƒ¼ã€ã¨æ€ã£ã¦ã„ãŸã‚‰ã€ã©ã†ã‚‚ Ubuntu ã§ã¯ ufw ã¨ã„ã†
n2s 2014/11/26
Linux

iptables

ufw
ãƒªãƒ³ã‚¯
Vagrantã‚’GWã«ã—ã¦ãƒ›ã‚¹ãƒˆã‹ã‚‰ç›´æŽ¥Dockerã‚‹ - Qiita
é³¥é ãªã®ã§ãƒãƒ¼ãƒˆç•ªå·ã‚’è¦šãˆã‚‰ã‚Œã¾ã›ã‚“ å°‘ã—èªžå¼ŠãŒã‚ã‚‹ã¨æ€ã„ã¾ã™ãŒã€ãƒãƒ¼ãƒˆç•ªå·è‡ªä½“ã‚’è¦šãˆã‚‰ã‚Œãªã„ã®ã§ã¯ãªãã€ãã®å ´ã§æ±ºã‚ãŸç‰¹æ®Šãªãƒãƒ¼ãƒˆç•ªå·ãŒè¦šãˆã‚‰ã‚Œã¾ã›ã‚“ã€‚ ä»Šã©ãã¯1024ä»¥ä¸‹ã«é–¢ã‚ã‚‰ãšãªã‚“ã‹ã‚‰ã®å®šç•ªãƒãƒ¼ãƒˆç•ªå·ãŒã‚ã‚Šã¾ã™ã€‚1521,3000,5432,8080ãªã©ãªã©ã€‚ ã“ã‚Œã‚‰ã¯äº‹å®Ÿä¸Šã®well-knownãƒãƒ¼ãƒˆã§ã‚ã‚Šã€ã“ã®ã‚µãƒ¼ãƒ“ã‚¹ã¯ã“ã®ç•ªå·ã¨ã„ã†ã®ãŒä½“ã«æŸ“ã¿ã¤ã„ã¦ã„ã¾ã™ã€‚ç‰¹ã«8080ã¨ã‹ã¯ãƒ–ãƒ©ã‚¦ã‚¶ãƒ‡ãƒãƒƒã‚°ã™ã‚‹ã¨ãã‚¢ãƒ‰ãƒ¬ã‚¹ã¨ã‚»ãƒƒãƒˆã§å‹æ‰‹ã«ä½“ãŒå…¥åŠ›ã—ã¦ã—ã¾ã†ç¨‹åº¦ã«æœ«ç«¯ç¥žçµŒãŒæ¯’ã•ã‚Œã¦ã„ã¾ã™ã€‚ ä½•ãŒè¨€ã„ãŸã„ã®ã‹ã¨ã„ã†ã¨ã€ã‚ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã«å¯¾ã—ã¦ãƒãƒ¼ãƒˆãƒ•ã‚©ãƒ¯ãƒ¼ãƒ‰ã—ãŸã¨ãã€ãã®ãƒãƒ¼ãƒˆç•ªå·ã‚’ãƒ–ãƒ©ã‚¦ã‚¶ãªã‚Šã«æ‰“ã¡è¾¼ã‚“ã ã‚Šã™ã‚‹ã¨ãã«å°‘ã—é–“ãŒé–‹ã„ã¦ã—ã¾ã„ãªã‚“ã‹æ°—æŒã¡æ‚ªã„ã¨ã„ã†ã ã‘ã®è©±ã§ã™ã€‚ å‹•ä½œã‚’æƒ³å®šã—ã¦ã„ã‚‹ç’°å¢ƒ ã€ŒVagrantã¨Dockerã‚’ä½¿ã£ã¦ç’°å¢ƒã«ä¾å˜ã›ãšã«Chefã®ãŠå‹‰å¼·ãŒã—ãŸã„ã€ã§æ›¸ã„ãŸã®ã§ã™ãŒã€ã¼
n2s 2014/10/03
Docker

Vagrant

iptables
ãƒªãƒ³ã‚¯
heartbleedã‚’iptablesã§æ¢ã‚ã‚‹ã“ã¨ã«ã¤ã„ã¦ - yasulib memo
å‰æ›¸ã OpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0160ï¼‰ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ è©³ç´°ã¯piyokangoã•ã‚“ã®ç´ æ™´ã‚‰ã—ã„ã¾ã¨ã‚ã‚’å‚ç…§ã—ã¦ãã ã•ã„ã€‚ OpenSSLã®è„†å¼±æ€§ï¼ˆCVE-2014-0160ï¼‰é–¢é€£ã®æƒ…å ±ã‚’ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚°ã«ã¦ã€ãƒˆãƒ¼ãƒžãƒ„ã®å²©äº•ã•ã‚“ãŒæ›¸ã„ãŸèˆˆå‘³æ·±ã„è¨˜äº‹ãŒã‚ã‚Šã¾ã—ãŸã€‚ ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : Openssl Heartbleed æ”»æ’ƒã®æ¤œçŸ¥ã«ã¤ã„ã¦ ï¼ƒæ ¹æœ¬çš„ãªå¯¾ç–ã§ã¯ãªãã€ã‚ãã¾ã§æ”»æ’ƒæ¤œçŸ¥ã¨ã„ã†æ„å‘³ã§ã€‚ iptables log rules iptables -t filter -A INPUT -p tcp --dport 443 -m u32 --u32 "52=0x18030000:0x1803FFFF" -j LOG --log-prefix "BLOCKED: HEARTBEAT" iptables block rules i
n2s 2014/04/14
Heartbleed

iptables
ãƒªãƒ³ã‚¯
ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : Openssl Heartbleed æ”»æ’ƒã®æ¤œçŸ¥ã«ã¤ã„ã¦
Openssl Heartbleed æ”»æ’ƒã®æ¤œçŸ¥ã«ã¤ã„ã¦ 2014å¹´04æœˆ11æ—¥18:08 ãƒ„ã‚¤ãƒ¼ãƒˆ hiroki_iwa1 ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ã‚³ãƒ¡ãƒ³ãƒˆÂ byï¼šå²©äº• åšæ¨¹ ã“ã“æ•°å¹´ã§æœ€æ‚ªã®è„†å¼±æ€§ã¨è¨€ã‚ã‚Œã¦ã„ã‚‹OpenSSL Heartbleedã§ã™ãŒã€ãã‚ãã‚è„†å¼±æ€§ã¸ã®å¯¾å¿œã‚’çµ‚ãˆã€ãƒ›ãƒƒã¨ä¸€æ¯ã„ã‚Œã¦ã„ã‚‹çµ„ç¹”ã‚‚å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ ï¼ƒShodanã§ç¢ºèªã™ã‚‹é™ã‚Šã§ã¯å¯¾å¿œãŒè¿½ã„ã¤ã„ã¦ã„ãªã„ã¨ã“ã‚ãŒã‚ã‚‹ã‚ˆã†ã§ã™ãŒãƒ»ãƒ»ãƒ» ã¾ãŸã€å€‹äººãƒ¬ãƒ™ãƒ«ã§ã¯SNSã‚„ã‚¯ãƒ©ã‚¦ãƒ‰ãƒ»ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ãªã©ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å¤‰æ›´ã‚‚å¿˜ã‚Œãšã«å®Ÿæ–½ã—ã¦ãŠããŸã„ã¨ã“ã‚ã§ã™ã€‚ å‚è€ƒï¼š The Heartbleed Hit List: The Passwords You Need to Change Right Now Heartbleed Bug Health Report [è¿½è¨˜] ã•ã¦ã€æ—¢ã«å ±é“ãªã©ã§ã®å ±å‘Šã®é€šã‚Šã€ä»Šå›žã®æ”»æ’ƒã¯ã‚µãƒ¼ãƒä¸Šã®ãƒã‚°ãªã©
n2s 2014/04/14
Heartbleed

iptables
ãƒªãƒ³ã‚¯
iptablesã®å¾Œç¶™ã¨ãªã‚‹nftablesãŒLinuxã‚«ãƒ¼ãƒãƒ«ã«ãƒžãƒ¼ã‚¸ã•ã‚ŒãŸã®ã‹ - YAMDASç¾æ›´æ–°å±¥æ´
Linuxã‚«ãƒ¼ãƒãƒ«3.13ãƒªãƒªãƒ¼ã‚¹ã€nftablesã‚„ãƒ–ãƒãƒƒã‚¯ãƒ‡ãƒã‚¤ã‚¹ãƒ¬ã‚¤ãƒ¤ãƒ¼ã®æ”¹è‰¯ãªã©ãŒç‰¹å¾´ | SourceForge.JP Magazine ä»Šã§ã¯ã‚‚ã†èª°ã‚‚çŸ¥ã‚‰ã‚“ã¨æ€ã†ãŒã€ãƒ¯ã‚¿ã‚·ã¯ã‹ã¤ã¦ Linux JF (Japanese FAQ) Project ã« Linux 2.4 NAT HOWTO ã‚„ netfilter/iptables FAQ ã®ç¿»è¨³ã‚’æä¾›ã—ã¦ãŠã‚Šã€netfilter/iptables ã«ã¯ãã‚Œãªã‚Šã«ç²¾é€šã—ã¦ã„ãŸã®ã§ã‚ã‚‹ã€‚ ä½™è«‡ã ãŒã€JF ã«ã¯ä»–ã«ã‚‚ã„ãã¤ã‹ãƒ¯ã‚¿ã‚·ã®ç¿»è¨³ãŒã‚ã‚‹ã®ã ãŒã€ã©ã‚Œã‚‚10å¹´ä»¥ä¸ŠçµŒã¡ã€ç¾ä»£çš„ãªä¾¡å€¤ã¯çš†ç„¡ã ã‚ã†ãªãâ€¦â€¦ã€‚ ãã‚Œã¯ã•ã¦ãŠãã€iptablesï¼ˆæ£ç¢ºã«ã¯ãã‚Œã«åŠ ãˆã¦ ip6tables ã¨ arpta bles ã¨ ebtablesï¼‰ã®å¾Œç¶™ã¨ãªã‚‹ nftables ãŒ Linux ã‚«ãƒ¼ãƒãƒ«ã«ãƒžãƒ¼ã‚¸ã•ã‚ŒãŸã‚“ã‚„ãã€‚ãƒ¯ã‚¿ã‚·ãªã© nftables ã®
n2s 2014/01/24
ã“ã®è¨˜äº‹ã‚’RSSã§è¦‹ã¤ã‘ãªã‘ã‚Œã°nftablesã®å˜åœ¨ã‚’çŸ¥ã‚‹ã®ãŒé…ã‚Œã¦ã„ãŸã‹ã‚‚ã—ã‚Œãªã„â€¦iptablesãƒ»ip6tablesãƒ»arptablesãƒ»ebtablesã‚’ã²ã£ãã‚‹ã‚ãŸå¾Œç¶™ã‚‰ã—ã„

Linux

iptables
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸