onionvps

指南

A correct nftables firewall, including IPv6

中级阅读时间 15 分钟更新时间 2026年4月22日
简短回答

nftables 通过 inet 家族用单一统一规则集替代 iptables，同时覆盖 IPv4 和 IPv6。正确的基础策略默认丢弃入站流量，接受已建立的连接，允许回环和 ICMP，并且只开放您提供服务的端口。

01 Why the inet family matters

The most common firewall mistake on a modern VPS is a v4-only ruleset. Every OnionVPS instance has a routed IPv6 /64, so services remain fully reachable over v6 unless the ruleset covers both. The inet family covers both in one place.

02 A complete base ruleset

Write it to /etc/nftables.conf and enable the service. Keep a second session open while testing.

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif lo accept

    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    tcp dport { 22, 80, 443 } accept
    udp dport 51820 accept          # WireGuard

    limit rate 5/minute burst 10 packets log prefix "nft-drop: "
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output  { type filter hook output  priority 0; policy accept; }
}

03 Apply it safely

Schedule a flush before applying, so a mistake resolves itself rather than requiring the console.

echo 'nft flush ruleset' | at now + 10 minutes
nft -f /etc/nftables.conf
# verify you are still connected, then:
atrm $(atq | cut -f1)
systemctl enable nftables

04 Never block ICMPv6

IPv6 depends on ICMPv6 for neighbour discovery and path MTU discovery. Blocking it wholesale, which people do out of IPv4 habit, produces intermittent failures that are extremely hard to diagnose.

常见问题

Should I use nftables or ufw?

ufw is a friendlier front end and handles both address families correctly by default. Use nftables directly when you need rules ufw cannot express, such as rate limiting or NAT.

How do I see what is being dropped?

上面的日志规则以 "nft-drop" 前缀写入内核日志；使用 journalctl -k -g nft-drop 读取。