mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-26 21:30:55 +08:00
geekpi
GitHub
commit
13afe13c90
@ -1,82 +0,0 @@
|
|||||||
[#]: subject: "Monitor your Linux firewall with nftwatch"
|
|
||||||
[#]: via: "https://opensource.com/article/22/7/nftwatch-linux-firewall"
|
|
||||||
[#]: author: "Kenneth Aaron https://opensource.com/users/flyingrhino"
|
|
||||||
[#]: collector: "lkxed"
|
|
||||||
[#]: translator: "geekpi"
|
|
||||||
[#]: reviewer: " "
|
|
||||||
[#]: publisher: " "
|
|
||||||
[#]: url: " "
|
|
||||||
|
|
||||||
Monitor your Linux firewall with nftwatch
|
|
||||||
======
|
|
||||||
I created the Linux nftwatch command to watch firewall traffic stats.
|
|
||||||
|
|
||||||
Netfilter tables ([nftables][4]) is the default firewall shipped with modern Linux distros. It's available on Fedora and RHEL 8, the latest Debian, and many others. It replaces the older iptables that was bundled in earlier distro releases. It's a powerful and worthy replacement for iptables, and as someone who uses it extensively, I appreciate its power and functionality.
|
|
||||||
|
|
||||||
One of the features of nftables is the ability to add counters to many elements, such as rules. These are enabled on demand. You need to explicitly ask for it on a per line basis using the "counter" argument. I have them enabled for specific rules in my firewall, which gives me visibility into those rules.
|
|
||||||
|
|
||||||
This got me thinking. How can I look at these counters in real time? At first I tried "watch" which allows things like refresh rate, but I didn't like the default format and it wasn't scrollable. I found using `head` and `tail` and `awk` less than ideal. A user-friendly solution didn't exist. So I wrote my own, which I'd like to share with the open source community.
|
|
||||||
|
|
||||||
### Introducing nftwatch on Linux
|
|
||||||
|
|
||||||
My solution, which I call nftwatch, does a few things:
|
|
||||||
|
|
||||||
* It reorders and reformats the nftables output to make it more readable.
|
|
||||||
* It allows scrolling the output up or down.
|
|
||||||
* Its user-defined refresh rate (can be changed in real time).
|
|
||||||
* It can pause the display.
|
|
||||||
|
|
||||||
Instead of a dump of a table, you get output that shows activity for each rule:
|
|
||||||
|
|
||||||
![Image of nftwatch][5]
|
|
||||||
|
|
||||||
(Kenneth Aaron, CC BY-SA 4.0)
|
|
||||||
|
|
||||||
You can download it here from its [Git repository][6].
|
|
||||||
|
|
||||||
It is 100% python, 100% open source, and 100% free. It ticks all the boxes for free, quality programs.
|
|
||||||
|
|
||||||
### Install nftwatch on Linux
|
|
||||||
|
|
||||||
Here are the manual install instructions:
|
|
||||||
|
|
||||||
1. Clone or download the project from the git repository.
|
|
||||||
2. Copy `nftwatch.yml` to `/etc/nftwatch.yml`.
|
|
||||||
3. Copy `nftwatch` to `/usr/local/bin/nftwatch` and grant it executable permissions using `chmod a+x`.
|
|
||||||
4. Use `nftwatch` with no args to run it.
|
|
||||||
5. See `nftwatch -m` for the man page.
|
|
||||||
|
|
||||||
You can also run nftwatch without the [YAML][7] config file, in which case it uses builtin defaults.
|
|
||||||
|
|
||||||
### Usage
|
|
||||||
|
|
||||||
The nftwatch command displays nftables rules. Most of the controls are designed for this purpose.
|
|
||||||
|
|
||||||
Arrow keys and the equivalent Vim keypresses control scrolling. Use the **F** or **S** key to change the refresh speed. Use the **P** key to pause the display.
|
|
||||||
|
|
||||||
Run `nftwatch -m` for full instructions, and a list of interactive key controls.
|
|
||||||
|
|
||||||
### A new view of your firewall
|
|
||||||
|
|
||||||
Firewalls can seem obtuse and vague even if you spend time to configure them. Aside from extrapolating indicators from log entries, it's hard to tell what kind of activity your firewall is actually seeing. With nftwatch, you can see your firewall at work, and ideally gain a better understanding of the kind of traffic your network has to deal with on a daily basis.
|
|
||||||
|
|
||||||
--------------------------------------------------------------------------------
|
|
||||||
|
|
||||||
via: https://opensource.com/article/22/7/nftwatch-linux-firewall
|
|
||||||
|
|
||||||
作者：[Kenneth Aaron][a]
|
|
||||||
选题：[lkxed][b]
|
|
||||||
译者：[译者ID](https://github.com/译者ID)
|
|
||||||
校对：[校对者ID](https://github.com/校对者ID)
|
|
||||||
|
|
||||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
|
||||||
|
|
||||||
[a]: https://opensource.com/users/flyingrhino
|
|
||||||
[b]: https://github.com/lkxed
|
|
||||||
[1]: https://opensource.com/sites/default/files/lead-images/coffee_tea_laptop_computer_work_desk.png
|
|
||||||
[2]: https://unsplash.com/@jonasleupe?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
|
|
||||||
[3]: https://unsplash.com/s/photos/tea-cup-computer?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
|
|
||||||
[4]: https://developers.redhat.com/blog/2016/10/28/what-comes-after-iptables-its-successor-of-course-nftables?extIdCarryOver=true&sc_cid=701f2000001OH79AAG#getting_started
|
|
||||||
[5]: https://opensource.com/sites/default/files/2022-07/nftwatch-sample.png
|
|
||||||
[6]: https://github.com/flyingrhinonz/nftwatch](https://github.com/flyingrhinonz/nftwatch
|
|
||||||
[7]: https://opensource.com/article/21/9/yaml-cheat-sheet
|
|
||||||
@ -2,7 +2,7 @@
|
|||||||
[#]: via: "https://itsfoss.com/uninstall-deb-ubuntu/"
|
[#]: via: "https://itsfoss.com/uninstall-deb-ubuntu/"
|
||||||
[#]: author: "Abhishek Prakash https://itsfoss.com/"
|
[#]: author: "Abhishek Prakash https://itsfoss.com/"
|
||||||
[#]: collector: "lkxed"
|
[#]: collector: "lkxed"
|
||||||
[#]: translator: " "
|
[#]: translator: "geekpi"
|
||||||
[#]: reviewer: " "
|
[#]: reviewer: " "
|
||||||
[#]: publisher: " "
|
[#]: publisher: " "
|
||||||
[#]: url: " "
|
[#]: url: " "
|
||||||
|
|||||||
@ -0,0 +1,82 @@
|
|||||||
|
[#]: subject: "Monitor your Linux firewall with nftwatch"
|
||||||
|
[#]: via: "https://opensource.com/article/22/7/nftwatch-linux-firewall"
|
||||||
|
[#]: author: "Kenneth Aaron https://opensource.com/users/flyingrhino"
|
||||||
|
[#]: collector: "lkxed"
|
||||||
|
[#]: translator: "geekpi"
|
||||||
|
[#]: reviewer: " "
|
||||||
|
[#]: publisher: " "
|
||||||
|
[#]: url: " "
|
||||||
|
|
||||||
|
用 nftwatch 监控你的 Linux 防火墙
|
||||||
|
======
|
||||||
|
我创建了 Linux nftwatch 命令来观察防火墙的流量统计。
|
||||||
|
|
||||||
|
Netfilter 表（[nftables][4]）是现代 Linux 发行版中的默认防火墙。它在 Fedora 和 RHEL 8、最新的 Debian 和许多其他版本上都有。它取代了早期发行版中捆绑的旧版 iptables。它是一个强大的、值得替代的 iptables，作为一个广泛使用它的人，我欣赏它的能力和功能。
|
||||||
|
|
||||||
|
nftables 的一个特点是能够为许多元素添加计数器，例如规则。这些都是按需启用的。你需要使用 “counter” 参数，在每一行明确地要求它。我为我的防火墙中的特定规则启用了这些计数器，这使我能够看到这些规则。
|
||||||
|
|
||||||
|
这让我开始思考。我怎样才能实时查看这些计数器？一开始我尝试了 “watch”，它允许诸如刷新率之类的东西，但我不喜欢默认格式，而且它不能滚动。我发现使用 `head` 和 `tail` 以及 `awk` 并不理想。一个用户友好的解决方案并不存在。所以我自己写了一个，我想与开源社区分享。
|
||||||
|
|
||||||
|
### Linux 上的 nftwatch 介绍
|
||||||
|
|
||||||
|
我的解决方案，我称之为 nftwatch，做了几件事。
|
||||||
|
|
||||||
|
* 它对 nftables 的输出进行重新排序和改写，使其更具有可读性。
|
||||||
|
* 它允许向上或向下滚动输出。
|
||||||
|
* 它的用户定义的刷新率（可以实时改变）。
|
||||||
|
* 它可以暂停显示。
|
||||||
|
|
||||||
|
你得到的不是一个表格的转储，而是显示每个规则活动的输出。
|
||||||
|
|
||||||
|
![Image of nftwatch][5]
|
||||||
|
|
||||||
|
（Kenneth Aaron，CC BY-SA 4.0）
|
||||||
|
|
||||||
|
你可以从它的 [Git 仓库][6]下载它。
|
||||||
|
|
||||||
|
它是 100% 的 Python，100% 的开源，100% 的免费。它满足了所有免费的高质量程序的要求。
|
||||||
|
|
||||||
|
### 在 Linux 上安装 nftwatch
|
||||||
|
|
||||||
|
以下是手动安装说明：
|
||||||
|
|
||||||
|
1. 克隆或从 git 仓库下载该项目。
|
||||||
|
2. 将 `nftwatch.yml` 复制到 `/etc/nftwatch.yml`。
|
||||||
|
3. 将 `nftwatch` 复制到 `/usr/local/bin/nftwatch` 并使用 `chmod a+x` 授予其可执行权限。
|
||||||
|
4. 使用 `nftwatch`，不带任何参数来运行它。
|
||||||
|
5. 参见 `nftwatch -m` 的手册。
|
||||||
|
|
||||||
|
你也可以在没有 [YAML][7] 配置文件的情况下运行 nftwatch，在这种情况下它使用内置的默认值。
|
||||||
|
|
||||||
|
### 使用
|
||||||
|
|
||||||
|
nftwatch 命令显示 nftables 规则。大多数控制都是为此目的而设计的。
|
||||||
|
|
||||||
|
箭头键和相当于 Vim 的按键控制滚动。使用 **F** 或 **S** 键来改变刷新速度。使用 **P** 键来暂停显示。
|
||||||
|
|
||||||
|
运行 `nftwatch -m` 以获得完整的说明，以及交互式按键控制的列表。
|
||||||
|
|
||||||
|
### 防火墙的新观点
|
||||||
|
|
||||||
|
即使你花时间去配置防火墙，它也会显得晦涩难懂和模糊不清。除了从日志条目中推断指标外，很难判断你的防火墙实际看到的活动类型。 使用 nftwatch，你可以看到你的防火墙在工作，并且可以更好地了解你的网络每天需要处理的流量类型。
|
||||||
|
|
||||||
|
--------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
via: https://opensource.com/article/22/7/nftwatch-linux-firewall
|
||||||
|
|
||||||
|
作者：[Kenneth Aaron][a]
|
||||||
|
选题：[lkxed][b]
|
||||||
|
译者：[geekpi](https://github.com/geekpi)
|
||||||
|
校对：[校对者ID](https://github.com/校对者ID)
|
||||||
|
|
||||||
|
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||||
|
|
||||||
|
[a]: https://opensource.com/users/flyingrhino
|
||||||
|
[b]: https://github.com/lkxed
|
||||||
|
[1]: https://opensource.com/sites/default/files/lead-images/coffee_tea_laptop_computer_work_desk.png
|
||||||
|
[2]: https://unsplash.com/@jonasleupe?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
|
||||||
|
[3]: https://unsplash.com/s/photos/tea-cup-computer?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText
|
||||||
|
[4]: https://developers.redhat.com/blog/2016/10/28/what-comes-after-iptables-its-successor-of-course-nftables?extIdCarryOver=true&sc_cid=701f2000001OH79AAG#getting_started
|
||||||
|
[5]: https://opensource.com/sites/default/files/2022-07/nftwatch-sample.png
|
||||||
|
[6]: https://github.com/flyingrhinonz/nftwatch](https://github.com/flyingrhinonz/nftwatch
|
||||||
|
[7]: https://opensource.com/article/21/9/yaml-cheat-sheet
|
||||||
Loading…
Reference in New Issue
Block a user