[{"data":1,"prerenderedAt":1058},["ShallowReactive",2],{"wiki-/wiki/security/nftables":3},{"id":4,"title":5,"body":6,"description":1050,"extension":1051,"meta":1052,"navigation":227,"path":1053,"section":1054,"seo":1055,"stem":1056,"__hash__":1057},"wiki/wiki/security/nftables.md","Управление файрволом через nftables",{"type":7,"value":8,"toc":1032},"minimark",[9,21,27,30,35,38,42,58,62,73,77,82,85,114,117,133,136,154,158,174,178,189,194,522,529,533,554,558,572,579,583,586,617,620,663,666,718,722,734,741,744,760,764,774,788,801,815,819,825,830,844,851,856,870,873,883,909,923,986,990,1009,1013,1028],[10,11,12,16,17,20],"p",{},[13,14,15],"strong",{},"Время:"," 20 мин · ",[13,18,19],{},"Сложность:"," ★★★☆☆",[10,22,23,26],{},[13,24,25],{},"Подходит:"," ✓ Ubuntu 22.04 · ✓ Debian 12 · ✓ AlmaLinux 9",[28,29],"hr",{},[31,32,34],"h2",{"id":33},"краткое-описание","Краткое описание",[10,36,37],{},"nftables — низкоуровневый фреймворк фильтрации пакетов, встроенный в ядро Linux начиная с версии 3.13. Он заменяет iptables, ip6tables, arptables и ebtables единым интерфейсом. UFW и firewalld работают поверх nftables, но прямая работа с ним даёт полный контроль: можно настраивать лимиты скорости, метки пакетов, сложные цепочки — то, что недоступно через упрощённые обёртки.",[31,39,41],{"id":40},"когда-пригодится","Когда пригодится",[43,44,45,49,52,55],"ul",{},[46,47,48],"li",{},"Когда UFW недостаточно гибкий для вашей задачи",[46,50,51],{},"При настройке NAT, маршрутизации или прозрачного проксирования",[46,53,54],{},"Если нужно ограничить скорость соединений (rate limiting)",[46,56,57],{},"При миграции с iptables на современный стек",[31,59,61],{"id":60},"что-понадобится","Что понадобится",[43,63,64,67,70],{},[46,65,66],{},"Root-доступ к серверу",[46,68,69],{},"Базовое понимание сетевых протоколов (TCP/UDP, IP-адреса, порты)",[46,71,72],{},"VNC-доступ к серверу на случай если заблокируете SSH",[31,74,76],{"id":75},"пошаговая-инструкция","Пошаговая инструкция",[78,79,81],"h3",{"id":80},"установка","Установка",[10,83,84],{},"На Ubuntu и Debian:",[86,87,92],"pre",{"className":88,"code":89,"language":90,"meta":91,"style":91},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","apt install -y nftables\n","bash","",[93,94,95],"code",{"__ignoreMap":91},[96,97,100,104,108,111],"span",{"class":98,"line":99},"line",1,[96,101,103],{"class":102},"sBMFI","apt",[96,105,107],{"class":106},"sfazB"," install",[96,109,110],{"class":106}," -y",[96,112,113],{"class":106}," nftables\n",[10,115,116],{},"На AlmaLinux:",[86,118,120],{"className":88,"code":119,"language":90,"meta":91,"style":91},"dnf install -y nftables\n",[93,121,122],{"__ignoreMap":91},[96,123,124,127,129,131],{"class":98,"line":99},[96,125,126],{"class":102},"dnf",[96,128,107],{"class":106},[96,130,110],{"class":106},[96,132,113],{"class":106},[10,134,135],{},"Включите автозапуск:",[86,137,139],{"className":88,"code":138,"language":90,"meta":91,"style":91},"systemctl enable --now nftables\n",[93,140,141],{"__ignoreMap":91},[96,142,143,146,149,152],{"class":98,"line":99},[96,144,145],{"class":102},"systemctl",[96,147,148],{"class":106}," enable",[96,150,151],{"class":106}," --now",[96,153,113],{"class":106},[78,155,157],{"id":156},"просмотр-текущих-правил","Просмотр текущих правил",[86,159,161],{"className":88,"code":160,"language":90,"meta":91,"style":91},"nft list ruleset\n",[93,162,163],{"__ignoreMap":91},[96,164,165,168,171],{"class":98,"line":99},[96,166,167],{"class":102},"nft",[96,169,170],{"class":106}," list",[96,172,173],{"class":106}," ruleset\n",[78,175,177],{"id":176},"создание-базовой-таблицы-с-политикой-запрета","Создание базовой таблицы с политикой запрета",[10,179,180,181,184,185,188],{},"Следующие команды создают таблицу ",[93,182,183],{},"filter"," для IPv4 и IPv6 (",[93,186,187],{},"inet","), три стандартные цепочки и базовые разрешающие правила.",[10,190,191],{},[13,192,193],{},"Выполняйте команды последовательно и не закрывайте SSH-сессию до проверки:",[86,195,197],{"className":88,"code":196,"language":90,"meta":91,"style":91},"# Создать таблицу\nnft add table inet filter\n\n# Создать цепочки с политикой по умолчанию\nnft add chain inet filter input { type filter hook input priority 0 \\; policy drop \\; }\nnft add chain inet filter forward { type filter hook forward priority 0 \\; policy drop \\; }\nnft add chain inet filter output { type filter hook output priority 0 \\; policy accept \\; }\n\n# Разрешить уже установленные соединения\nnft add rule inet filter input ct state established,related accept\n\n# Разрешить трафик на loopback-интерфейсе\nnft add rule inet filter input iif lo accept\n\n# Разрешить SSH\nnft add rule inet filter input tcp dport 22 accept\n\n# Разрешить HTTP и HTTPS\nnft add rule inet filter input tcp dport { 80, 443 } accept\n",[93,198,199,205,222,229,235,288,328,369,374,380,408,413,419,442,447,453,479,484,490],{"__ignoreMap":91},[96,200,201],{"class":98,"line":99},[96,202,204],{"class":203},"sHwdD","# Создать таблицу\n",[96,206,208,210,213,216,219],{"class":98,"line":207},2,[96,209,167],{"class":102},[96,211,212],{"class":106}," add",[96,214,215],{"class":106}," table",[96,217,218],{"class":106}," inet",[96,220,221],{"class":106}," filter\n",[96,223,225],{"class":98,"line":224},3,[96,226,228],{"emptyLinePlaceholder":227},true,"\n",[96,230,232],{"class":98,"line":231},4,[96,233,234],{"class":203},"# Создать цепочки с политикой по умолчанию\n",[96,236,238,240,242,245,247,250,253,256,259,261,264,266,269,273,277,280,283,285],{"class":98,"line":237},5,[96,239,167],{"class":102},[96,241,212],{"class":106},[96,243,244],{"class":106}," chain",[96,246,218],{"class":106},[96,248,249],{"class":106}," filter",[96,251,252],{"class":106}," input",[96,254,255],{"class":106}," {",[96,257,258],{"class":106}," type",[96,260,249],{"class":106},[96,262,263],{"class":106}," hook",[96,265,252],{"class":106},[96,267,268],{"class":106}," priority",[96,270,272],{"class":271},"sbssI"," 0",[96,274,276],{"class":275},"sTEyZ"," \\; ",[96,278,279],{"class":106},"policy",[96,281,282],{"class":106}," drop",[96,284,276],{"class":275},[96,286,287],{"class":106},"}\n",[96,289,291,293,295,297,299,301,304,306,308,310,312,314,316,318,320,322,324,326],{"class":98,"line":290},6,[96,292,167],{"class":102},[96,294,212],{"class":106},[96,296,244],{"class":106},[96,298,218],{"class":106},[96,300,249],{"class":106},[96,302,303],{"class":106}," forward",[96,305,255],{"class":106},[96,307,258],{"class":106},[96,309,249],{"class":106},[96,311,263],{"class":106},[96,313,303],{"class":106},[96,315,268],{"class":106},[96,317,272],{"class":271},[96,319,276],{"class":275},[96,321,279],{"class":106},[96,323,282],{"class":106},[96,325,276],{"class":275},[96,327,287],{"class":106},[96,329,331,333,335,337,339,341,344,346,348,350,352,354,356,358,360,362,365,367],{"class":98,"line":330},7,[96,332,167],{"class":102},[96,334,212],{"class":106},[96,336,244],{"class":106},[96,338,218],{"class":106},[96,340,249],{"class":106},[96,342,343],{"class":106}," output",[96,345,255],{"class":106},[96,347,258],{"class":106},[96,349,249],{"class":106},[96,351,263],{"class":106},[96,353,343],{"class":106},[96,355,268],{"class":106},[96,357,272],{"class":271},[96,359,276],{"class":275},[96,361,279],{"class":106},[96,363,364],{"class":106}," accept",[96,366,276],{"class":275},[96,368,287],{"class":106},[96,370,372],{"class":98,"line":371},8,[96,373,228],{"emptyLinePlaceholder":227},[96,375,377],{"class":98,"line":376},9,[96,378,379],{"class":203},"# Разрешить уже установленные соединения\n",[96,381,383,385,387,390,392,394,396,399,402,405],{"class":98,"line":382},10,[96,384,167],{"class":102},[96,386,212],{"class":106},[96,388,389],{"class":106}," rule",[96,391,218],{"class":106},[96,393,249],{"class":106},[96,395,252],{"class":106},[96,397,398],{"class":106}," ct",[96,400,401],{"class":106}," state",[96,403,404],{"class":106}," established,related",[96,406,407],{"class":106}," accept\n",[96,409,411],{"class":98,"line":410},11,[96,412,228],{"emptyLinePlaceholder":227},[96,414,416],{"class":98,"line":415},12,[96,417,418],{"class":203},"# Разрешить трафик на loopback-интерфейсе\n",[96,420,422,424,426,428,430,432,434,437,440],{"class":98,"line":421},13,[96,423,167],{"class":102},[96,425,212],{"class":106},[96,427,389],{"class":106},[96,429,218],{"class":106},[96,431,249],{"class":106},[96,433,252],{"class":106},[96,435,436],{"class":106}," iif",[96,438,439],{"class":106}," lo",[96,441,407],{"class":106},[96,443,445],{"class":98,"line":444},14,[96,446,228],{"emptyLinePlaceholder":227},[96,448,450],{"class":98,"line":449},15,[96,451,452],{"class":203},"# Разрешить SSH\n",[96,454,456,458,460,462,464,466,468,471,474,477],{"class":98,"line":455},16,[96,457,167],{"class":102},[96,459,212],{"class":106},[96,461,389],{"class":106},[96,463,218],{"class":106},[96,465,249],{"class":106},[96,467,252],{"class":106},[96,469,470],{"class":106}," tcp",[96,472,473],{"class":106}," dport",[96,475,476],{"class":271}," 22",[96,478,407],{"class":106},[96,480,482],{"class":98,"line":481},17,[96,483,228],{"emptyLinePlaceholder":227},[96,485,487],{"class":98,"line":486},18,[96,488,489],{"class":203},"# Разрешить HTTP и HTTPS\n",[96,491,493,495,497,499,501,503,505,507,509,511,514,517,520],{"class":98,"line":492},19,[96,494,167],{"class":102},[96,496,212],{"class":106},[96,498,389],{"class":106},[96,500,218],{"class":106},[96,502,249],{"class":106},[96,504,252],{"class":106},[96,506,470],{"class":106},[96,508,473],{"class":106},[96,510,255],{"class":106},[96,512,513],{"class":106}," 80,",[96,515,516],{"class":271}," 443",[96,518,519],{"class":106}," }",[96,521,407],{"class":106},[10,523,524,525,528],{},"Если SSH работает на нестандартном порту, замените ",[93,526,527],{},"22"," на свой порт.",[78,530,532],{"id":531},"сохранить-правила","Сохранить правила",[86,534,536],{"className":88,"code":535,"language":90,"meta":91,"style":91},"nft list ruleset > /etc/nftables.conf\n",[93,537,538],{"__ignoreMap":91},[96,539,540,542,544,547,551],{"class":98,"line":99},[96,541,167],{"class":102},[96,543,170],{"class":106},[96,545,546],{"class":106}," ruleset",[96,548,550],{"class":549},"sMK4o"," >",[96,552,553],{"class":106}," /etc/nftables.conf\n",[78,555,557],{"id":556},"загрузить-конфигурацию-из-файла","Загрузить конфигурацию из файла",[86,559,561],{"className":88,"code":560,"language":90,"meta":91,"style":91},"nft -f /etc/nftables.conf\n",[93,562,563],{"__ignoreMap":91},[96,564,565,567,570],{"class":98,"line":99},[96,566,167],{"class":102},[96,568,569],{"class":106}," -f",[96,571,553],{"class":106},[10,573,574,575,578],{},"На Ubuntu и Debian systemd-служба nftables автоматически загружает ",[93,576,577],{},"/etc/nftables.conf"," при старте системы.",[78,580,582],{"id":581},"дополнительные-полезные-правила","Дополнительные полезные правила",[10,584,585],{},"Блокировка конкретного IP:",[86,587,589],{"className":88,"code":588,"language":90,"meta":91,"style":91},"nft add rule inet filter input ip saddr 1.2.3.4 drop\n",[93,590,591],{"__ignoreMap":91},[96,592,593,595,597,599,601,603,605,608,611,614],{"class":98,"line":99},[96,594,167],{"class":102},[96,596,212],{"class":106},[96,598,389],{"class":106},[96,600,218],{"class":106},[96,602,249],{"class":106},[96,604,252],{"class":106},[96,606,607],{"class":106}," ip",[96,609,610],{"class":106}," saddr",[96,612,613],{"class":271}," 1.2.3.4",[96,615,616],{"class":106}," drop\n",[10,618,619],{},"Ограничение новых SSH-соединений (не более 3 в минуту):",[86,621,623],{"className":88,"code":622,"language":90,"meta":91,"style":91},"nft add rule inet filter input tcp dport 22 ct state new limit rate 3/minute accept\n",[93,624,625],{"__ignoreMap":91},[96,626,627,629,631,633,635,637,639,641,643,645,647,649,652,655,658,661],{"class":98,"line":99},[96,628,167],{"class":102},[96,630,212],{"class":106},[96,632,389],{"class":106},[96,634,218],{"class":106},[96,636,249],{"class":106},[96,638,252],{"class":106},[96,640,470],{"class":106},[96,642,473],{"class":106},[96,644,476],{"class":271},[96,646,398],{"class":106},[96,648,401],{"class":106},[96,650,651],{"class":106}," new",[96,653,654],{"class":106}," limit",[96,656,657],{"class":106}," rate",[96,659,660],{"class":106}," 3/minute",[96,662,407],{"class":106},[10,664,665],{},"Разрешить ICMP (ping):",[86,667,669],{"className":88,"code":668,"language":90,"meta":91,"style":91},"nft add rule inet filter input icmp type echo-request accept\nnft add rule inet filter input icmpv6 type echo-request accept\n",[93,670,671,695],{"__ignoreMap":91},[96,672,673,675,677,679,681,683,685,688,690,693],{"class":98,"line":99},[96,674,167],{"class":102},[96,676,212],{"class":106},[96,678,389],{"class":106},[96,680,218],{"class":106},[96,682,249],{"class":106},[96,684,252],{"class":106},[96,686,687],{"class":106}," icmp",[96,689,258],{"class":106},[96,691,692],{"class":106}," echo-request",[96,694,407],{"class":106},[96,696,697,699,701,703,705,707,709,712,714,716],{"class":98,"line":207},[96,698,167],{"class":102},[96,700,212],{"class":106},[96,702,389],{"class":106},[96,704,218],{"class":106},[96,706,249],{"class":106},[96,708,252],{"class":106},[96,710,711],{"class":106}," icmpv6",[96,713,258],{"class":106},[96,715,692],{"class":106},[96,717,407],{"class":106},[31,719,721],{"id":720},"проверка-результата","Проверка результата",[86,723,724],{"className":88,"code":160,"language":90,"meta":91,"style":91},[93,725,726],{"__ignoreMap":91},[96,727,728,730,732],{"class":98,"line":99},[96,729,167],{"class":102},[96,731,170],{"class":106},[96,733,173],{"class":106},[10,735,736,737,740],{},"Вывод должен содержать таблицу ",[93,738,739],{},"inet filter"," с тремя цепочками и добавленными правилами. Проверьте SSH-подключение из нового окна терминала.",[10,742,743],{},"Для просмотра счётчиков пакетов:",[86,745,747],{"className":88,"code":746,"language":90,"meta":91,"style":91},"nft list ruleset -a\n",[93,748,749],{"__ignoreMap":91},[96,750,751,753,755,757],{"class":98,"line":99},[96,752,167],{"class":102},[96,754,170],{"class":106},[96,756,546],{"class":106},[96,758,759],{"class":106}," -a\n",[31,761,763],{"id":762},"возможные-ошибки","Возможные ошибки",[10,765,766,769,770,773],{},[13,767,768],{},"Потеряли SSH-доступ"," — произошло если правило для SSH добавили после установки политики ",[93,771,772],{},"policy drop",". Перезагрузите сервер через панель VMmanager — правила nftables, не сохранённые в файл, после перезагрузки исчезнут. Затем добавьте правило для SSH перед установкой политики drop.",[10,775,776,779,780,783,784,787],{},[13,777,778],{},"Правила не сохраняются после перезагрузки"," — убедитесь что сохранили их командой ",[93,781,782],{},"nft list ruleset > /etc/nftables.conf"," и что служба nftables включена: ",[93,785,786],{},"systemctl is-enabled nftables",".",[10,789,790,793,794,797,798,787],{},[13,791,792],{},"«Error: syntax error» при добавлении правила"," — проверьте синтаксис. В nftables фигурные скобки при перечислении портов обязательны: ",[93,795,796],{},"{ 80, 443 }",", а не просто ",[93,799,800],{},"80, 443",[10,802,803,806,807,810,811,814],{},[13,804,805],{},"Конфликт с UFW или firewalld"," — не используйте несколько систем управления файрволом одновременно. Отключите UFW (",[93,808,809],{},"ufw disable",") или firewalld (",[93,812,813],{},"systemctl stop firewalld",") перед переходом на прямое управление через nftables.",[31,816,818],{"id":817},"faq","FAQ",[10,820,821,824],{},[13,822,823],{},"Чем nftables лучше iptables?","\nЕдиный синтаксис для IPv4 и IPv6, поддержка наборов (sets) для группировки адресов и портов, встроенный счётчик пакетов, более высокая производительность на больших наборах правил.",[10,826,827],{},[13,828,829],{},"Как посмотреть счётчики пакетов для каждого правила?",[86,831,832],{"className":88,"code":746,"language":90,"meta":91,"style":91},[93,833,834],{"__ignoreMap":91},[96,835,836,838,840,842],{"class":98,"line":99},[96,837,167],{"class":102},[96,839,170],{"class":106},[96,841,546],{"class":106},[96,843,759],{"class":106},[10,845,846,847,850],{},"Флаг ",[93,848,849],{},"-a"," добавляет счётчики байт и пакетов к каждому правилу.",[10,852,853],{},[13,854,855],{},"Как очистить все правила?",[86,857,859],{"className":88,"code":858,"language":90,"meta":91,"style":91},"nft flush ruleset\n",[93,860,861],{"__ignoreMap":91},[96,862,863,865,868],{"class":98,"line":99},[96,864,167],{"class":102},[96,866,867],{"class":106}," flush",[96,869,173],{"class":106},[10,871,872],{},"После этого весь трафик будет проходить без ограничений (политика по умолчанию — accept).",[10,874,875,878,879,882],{},[13,876,877],{},"Как удалить конкретное правило?","\nСначала получите дескриптор правила: ",[93,880,881],{},"nft -a list ruleset",". Затем удалите по дескриптору:",[86,884,886],{"className":88,"code":885,"language":90,"meta":91,"style":91},"nft delete rule inet filter input handle 5\n",[93,887,888],{"__ignoreMap":91},[96,889,890,892,895,897,899,901,903,906],{"class":98,"line":99},[96,891,167],{"class":102},[96,893,894],{"class":106}," delete",[96,896,389],{"class":106},[96,898,218],{"class":106},[96,900,249],{"class":106},[96,902,252],{"class":106},[96,904,905],{"class":106}," handle",[96,907,908],{"class":271}," 5\n",[10,910,911,914,915,918,919,922],{},[13,912,913],{},"Можно ли использовать nftables для NAT?","\nДа. Добавьте цепочку с хуком ",[93,916,917],{},"postrouting"," и тип ",[93,920,921],{},"nat",":",[86,924,926],{"className":88,"code":925,"language":90,"meta":91,"style":91},"nft add chain inet nat postrouting { type nat hook postrouting priority 100 \\; }\nnft add rule inet nat postrouting oif eth0 masquerade\n",[93,927,928,963],{"__ignoreMap":91},[96,929,930,932,934,936,938,941,944,946,948,950,952,954,956,959,961],{"class":98,"line":99},[96,931,167],{"class":102},[96,933,212],{"class":106},[96,935,244],{"class":106},[96,937,218],{"class":106},[96,939,940],{"class":106}," nat",[96,942,943],{"class":106}," postrouting",[96,945,255],{"class":106},[96,947,258],{"class":106},[96,949,940],{"class":106},[96,951,263],{"class":106},[96,953,943],{"class":106},[96,955,268],{"class":106},[96,957,958],{"class":271}," 100",[96,960,276],{"class":275},[96,962,287],{"class":106},[96,964,965,967,969,971,973,975,977,980,983],{"class":98,"line":207},[96,966,167],{"class":102},[96,968,212],{"class":106},[96,970,389],{"class":106},[96,972,218],{"class":106},[96,974,940],{"class":106},[96,976,943],{"class":106},[96,978,979],{"class":106}," oif",[96,981,982],{"class":106}," eth0",[96,984,985],{"class":106}," masquerade\n",[31,987,989],{"id":988},"полезные-ссылки","Полезные ссылки",[43,991,992,998,1003],{},[46,993,994,997],{},[93,995,996],{},"man nft"," — полная документация по синтаксису nftables",[46,999,1000,1002],{},[93,1001,577],{}," — файл конфигурации, загружаемый при старте",[46,1004,1005,1008],{},[93,1006,1007],{},"nft monitor"," — мониторинг изменений правил в реальном времени",[31,1010,1012],{"id":1011},"следующие-статьи","Следующие статьи",[43,1014,1015,1022],{},[46,1016,1017],{},[1018,1019,1021],"a",{"href":1020},"/wiki/security/ufw","Настройка UFW",[46,1023,1024],{},[1018,1025,1027],{"href":1026},"/wiki/linux/firewall","Настройка файрвола Linux",[1029,1030,1031],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}",{"title":91,"searchDepth":207,"depth":207,"links":1033},[1034,1035,1036,1037,1045,1046,1047,1048,1049],{"id":33,"depth":207,"text":34},{"id":40,"depth":207,"text":41},{"id":60,"depth":207,"text":61},{"id":75,"depth":207,"text":76,"children":1038},[1039,1040,1041,1042,1043,1044],{"id":80,"depth":224,"text":81},{"id":156,"depth":224,"text":157},{"id":176,"depth":224,"text":177},{"id":531,"depth":224,"text":532},{"id":556,"depth":224,"text":557},{"id":581,"depth":224,"text":582},{"id":720,"depth":207,"text":721},{"id":762,"depth":207,"text":763},{"id":817,"depth":207,"text":818},{"id":988,"depth":207,"text":989},{"id":1011,"depth":207,"text":1012},"Как настроить правила файрвола напрямую через nftables — замену iptables.","md",{},"/wiki/security/nftables","Безопасность",{"title":5,"description":1050},"wiki/security/nftables","rwSrRaE6QNI91X6aPDAlY8iiarS9_CcnwuNtT96_JsI",1788285515681]