• nftables en pratique — remplacer iptables sur Debian/Ubuntu

# Lister les tables
$ sudo nft list tables
table inet filter
table ip crowdsec
table ip6 crowdsec6

# lister les règles (peu être très long si crowdsec ou autre IDS)
sudo nft list ruleset

table inet filter {
        chain input {
                type filter hook input priority filter; policy accept;
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
table ip crowdsec {
        counter processed {
                packets 3593 bytes 7549768
        }

        counter crowdsec-blacklists-CAPI {
                packets 0 bytes 0
        }

        counter crowdsec-blacklists-lists-firehol_greensnow {
                packets 3 bytes 156
        }

        counter crowdsec-blacklists-lists-otx-webscanners {
                packets 0 bytes 0
        }

        counter crowdsec-blacklists-crowdsec {
                packets 0 bytes 0
        }

        set crowdsec-blacklists-CAPI {
                type ipv4_addr
                flags timeout
                elements = { 1.9.211.178 timeout 6d17h45m15s expires 6d17h38m17s708ms, 1.12.48.131 timeout 6d21h45m15s expires 6d21h38m17s740ms, ... } 
        set crowdsec-blacklists-crowdsec {
                type ipv4_addr
                flags timeout
                elements = { 41.43.191.126 timeout 15m45s expires 8m47s576ms }
        }

        chain crowdsec-chain-input {
                type filter hook input priority filter - 10; policy accept;
                counter name "processed"
                ip saddr @crowdsec-blacklists-CAPI counter name "crowdsec-blacklists-CAPI" drop
                ip saddr @crowdsec-blacklists-lists-firehol_greensnow counter name "crowdsec-blacklists-lists-firehol_greensnow" drop
                ip saddr @crowdsec-blacklists-lists-otx-webscanners counter name "crowdsec-blacklists-lists-otx-webscanners" drop
                ip saddr @crowdsec-blacklists-crowdsec counter name "crowdsec-blacklists-crowdsec" drop
        }

        chain crowdsec-chain-forward {
                type filter hook forward priority filter - 10; policy accept;
                counter name "processed"
                ip saddr @crowdsec-blacklists-CAPI counter name "crowdsec-blacklists-CAPI" drop
                ip saddr @crowdsec-blacklists-lists-firehol_greensnow counter name "crowdsec-blacklists-lists-firehol_greensnow" drop
                ip saddr @crowdsec-blacklists-lists-otx-webscanners counter name "crowdsec-blacklists-lists-otx-webscanners" drop
                ip saddr @crowdsec-blacklists-crowdsec counter name "crowdsec-blacklists-crowdsec" drop
        }
}
table ip6 crowdsec6 {
        counter processed {
                packets 17416 bytes 1282930
        }

        counter crowdsec6-blacklists-CAPI {
                packets 0 bytes 0
        }

        set crowdsec6-blacklists-CAPI {
                type ipv6_addr
                flags timeout
                elements = { 2001:470:2cc:1::15f timeout 6d21h45m15s expires 6d21h38m17s664ms, ... }
        chain crowdsec6-chain-input {
                type filter hook input priority filter - 10; policy accept;
                counter name "processed"
                ip6 saddr @crowdsec6-blacklists-CAPI counter name "crowdsec6-blacklists-CAPI" drop
        }

        chain crowdsec6-chain-forward {
                type filter hook forward priority filter - 10; policy accept;
                counter name "processed"
                ip6 saddr @crowdsec6-blacklists-CAPI counter name "crowdsec6-blacklists-CAPI" drop
        }
}