主页 / ubuntu / 问题

问题[nftables](ubuntu)

Martin Hope
iBug
Asked: 2020-11-25 12:14:40 +0800 CST
  • 6

update-alternatives --set iptables /usr/sbin/iptables-nft通过运行并重新启动服务器，我已将我的 Ubuntu Focal 服务器防火墙后端从旧版 iptables 迁移到 netfilter 。现在显示的所有表格iptables-legacy -S都是空的，但是当我运行iptables -S最后一行时总是说：

# Warning: iptables-legacy tables present, use iptables-legacy to see them

此后，我iptables-legacy使用以下命令从替代方案中删除：

update-alternatives --remove iptables /usr/sbin/iptables-legacy

现在只显示 netfilter 版本

root@iBug-Server:~# update-alternatives --display iptables
iptables - auto mode
  link best version is /usr/sbin/iptables-nft
  link currently points to /usr/sbin/iptables-nft
  link iptables is /usr/sbin/iptables
  slave iptables-restore is /usr/sbin/iptables-restore
  slave iptables-save is /usr/sbin/iptables-save
/usr/sbin/iptables-nft - priority 20
  slave iptables-restore: /usr/sbin/iptables-nft-restore
  slave iptables-save: /usr/sbin/iptables-nft-save

我怎样才能摆脱这个警告？

networking iptables firewall nftables
Martin Hope
Csaba Toth
Asked: 2019-12-21 22:51:16 +0800 CST
  • 2

不幸的是，我不知道它何时停止工作，因为我将它用作火灾而忘记了解决方案。不久前，我检查了一下，gufw惊讶地发现我的机器是裸露的。

root@asus:/etc/ufw# dpkg -l | grep ufw
ii  gufw   19.10.0-2
ii  ufw    0.36-1


root@asus:/etc/ufw# dpkg -l | grep tables
ii  iptables               1.8.4-11
ii  iptables-dev:amd64     1.8.3-2
ii  libnftables1:amd64     0.9.3-2
ii  libnftnl11:amd64       1.1.5-1
ii  libxtables-dev:amd64   1.8.4-1
ii  libxtables12:amd64     1.8.4-1
ii  nftables               0.9.3-2

我正在使用5.3.0-3-amd64内核运行。

实际错误：

root@asus:/# ufw enable
ERROR: problem running ufw-init
Bad argument `DROP'
Error occurred at line: 4
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 4
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore: line 2 failed
Bad argument `-'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.8.4 (nf_tables): Chain 'ufw-user-input' does not exist
Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Bad argument `DROP'
Error occurred at line: 4
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 4
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
ip6tables-restore: line 2 failed
Bad argument `-'
Error occurred at line: 3
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 3
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 3
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
Bad argument `-'
Error occurred at line: 3
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.
ip6tables-restore v1.8.4 (nf_tables): Chain 'ufw6-user-input' does not exist
Error occurred at line: 2
Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.

Problem running '/etc/ufw/user.rules'
Problem running '/etc/ufw/user6.rules'

我还没有发现任何关于这个的明显命中（很多 ufw 问题，但不是这种类型）。我想知道这是否与内核的iptables支持有关，nftables包以某种方式进入已安装的包或其他东西的事实？如果我删除before*.rules或因此我after*.rules得到/etc/ufw一个错误，脚本会查找这些文件。

我想知道是否有人对ufw enable. 现在我ufw的是不活动的。

root@asus:/etc/ufw# lsmod | grep tables
ip6_tables             36864  0
ip_tables              32768  0
x_tables               49152  17 xt_conntrack,nft_compat,xt_LOG,xt_multiport,xt_tcpudp,xt_hashlimit,xt_addrtype,xt_recent,ip6t_rt,xt_comment,ip6_tables,ipt_REJECT,ip_tables,xt_limit,xt_hl,xt_MASQUERADE,ip6t_REJECT
nf_tables             163840  46 nft_compat,nft_counter,nft_chain_nat,nft_limit
nfnetlink              16384  4 nft_compat,nf_conntrack_netlink,nf_tables
iptables ufw gufw nftables