我使用 AlmaLinux 9，我了解到有新的后端服务 nftables 可以通过 iptables-nft 命令进行管理，所以我设置了一些规则，我的规则集如下所示：
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
chain DOCKER {
iifname "docker0" counter packets 0 bytes 0 return
iifname != "docker0" tcp dport 8080 counter packets 3 bytes 180 dnat to 172.17.0.2:80
iifname != "docker0" tcp dport 9001 counter packets 4 bytes 240 dnat to 172.17.0.3:9001
}
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 9001 counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 9001 counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.3 ip daddr 172.17.0.3 tcp dport 9001 counter packets 0 bytes 0 masquerade
}
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
fib daddr type local counter packets 236 bytes 12653 jump DOCKER
fib daddr type local counter packets 39 bytes 1732 jump DOCKER
fib daddr type local counter packets 39 bytes 1732 jump DOCKER
fib daddr type local counter packets 23 bytes 1056 jump DOCKER
fib daddr type local counter packets 23 bytes 1056 jump DOCKER
}
chain OUTPUT {
type nat hook output priority dstnat; policy accept;
ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
}
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
chain FORWARD {
type filter hook forward priority filter; policy drop;
counter packets 178 bytes 55546 jump DOCKER-USER
counter packets 178 bytes 55546 jump DOCKER-ISOLATION-STAGE-1
oifname "docker0" ct state related,established counter packets 84 bytes 11338 accept
oifname "docker0" counter packets 7 bytes 420 jump DOCKER
iifname "docker0" oifname != "docker0" counter packets 87 bytes 43788 accept
iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
}
chain DOCKER-USER {
counter packets 178 bytes 55546 return
}
chain INPUT {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 195 bytes 18089 accept
tcp dport 22 counter packets 2 bytes 120 accept
tcp dport 443 counter packets 0 bytes 0 accept
}
chain DOCKER {
ip daddr 172.17.0.2 iifname != "docker0" oifname "docker0" tcp dport 80 counter packets 3 bytes 180 accept
ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 9001 counter packets 4 bytes 240 accept
}
chain DOCKER-ISOLATION-STAGE-1 {
iifname "docker0" oifname != "docker0" counter packets 87 bytes 43788 jump DOCKER-ISOLATION-STAGE-2
counter packets 178 bytes 55546 return
}
chain DOCKER-ISOLATION-STAGE-2 {
oifname "docker0" counter packets 0 bytes 0 drop
counter packets 87 bytes 43788 return
}
}
该规则集已保存，/etc/sysconfig/nftables.conf因此每次服务器重新启动时都会加载它，正如您在链 INPUT 中所看到的，除端口 22 和 443 之外的所有内容都应被删除，因此我尝试在端口 8080 上运行测试 nginx 服务器，并且我仍然可以访问它，我的防火墙没有阻止任何东西..为什么？即使 INPUT 策略设置为删除。
编辑2：
所以我读到docker使用DOCKER-USER链来制定用户定义的规则，所以我这样做了：
table ip filter {
chain FORWARD {
type filter hook forward priority filter; policy drop;
counter packets 0 bytes 0 jump DOCKER-USER
counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1
oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
oifname "docker0" counter packets 0 bytes 0 jump DOCKER
iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
oifname "docker0" ct state established,related counter packets 184 bytes 27570 accept
oifname "docker0" ct state established,related counter packets 85 bytes 28483 accept
}
chain DOCKER-USER {
counter packets 534 bytes 178277 return
tcp dport 8080 drop
tcp dport 9001 drop
}
chain INPUT {
type filter hook input priority filter; policy drop;
ct state established,related counter packets 584 bytes 54071 accept
tcp dport 22 counter packets 8 bytes 460 accept
}
chain DOCKER {
ip daddr 172.17.0.2 iifname != "docker0" oifname "docker0" tcp dport 80 counter packets 0 bytes 0 accept
ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 9001 counter packets 0 bytes 0 accept
}
chain DOCKER-ISOLATION-STAGE-1 {
iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
counter packets 0 bytes 0 return
}
chain DOCKER-ISOLATION-STAGE-2 {
oifname "docker0" counter packets 0 bytes 0 drop
counter packets 0 bytes 0 return
}
}
但仍然不起作用，我可以访问端口 8080 和 9001，甚至尝试重新启动服务器。
编辑3：
将我的链改为：
chain DOCKER-USER {
tcp dport 8080 drop
tcp dport 9001 drop
return
}
重新启动服务器，端口 8080 仍然可以访问
