فایروال سرور Debian با nftables

sudo apt update
sudo apt install -y nftables
sudo systemctl enable nftables

sudo cp /etc/nftables.conf /etc/nftables.conf.bak
sudo nano /etc/nftables.conf

#!/usr/sbin/nft -f
flush ruleset

define ADMIN_NET = { 192.168.10.0/24 }

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif lo accept
    ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } accept
    ip6 nexthdr icmpv6 accept

    ip saddr $ADMIN_NET tcp dport 22 ct state new limit rate 10/minute accept
    tcp dport { 80, 443 } accept

    counter log prefix "nft-drop: " level info
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output  { type filter hook output priority 0; policy accept; }
}

sudo nft -c -f /etc/nftables.conf

sudo cp /etc/nftables.conf /root/nftables.new
sudo cp /etc/nftables.conf.bak /etc/nftables.conf
sudo systemd-run --unit=nft-rollback --on-active=120 nft -f /etc/nftables.conf
sudo nft -f /root/nftables.new

sudo systemctl stop nft-rollback.timer
sudo cp /root/nftables.new /etc/nftables.conf
sudo systemctl restart nftables

sudo nft list ruleset
sudo journalctl -k -g nft-drop -n 20