Zen

Translation

However, Netfilter iptables commands are being replaced by nftables, which avoids many of its problems. Its design involves less code duplication, and it can be managed with just the <command>nft</command> command. Since Debian <emphasis role="distribution">Buster</emphasis>, the nftables framework is used by default. The commands mentioned before are provided by versions, which use the nftables kernel API, by default. If one requires the “classic“ commands, the relevant binaries can be adjusted using <command>update-alternatives</command>.
174/5460 · 546

Sign in to save the translation.

English Chinese (Simplified) Actions
<emphasis>SPECIFIC CASE</emphasis> Local Firewall
<emphasis>特例</emphasis> 局部防火墙
A firewall can be restricted to one particular machine (as opposed to a complete network), in which case its role is to filter or limit access to some services. It is, however, always better to configure services to not listen on those network interfaces, where these services are not supposed to be offered, or to disable and remove services, which are not to be offered at all, than to use a packet filter to prevent any unwanted access to these services.
防火墙可以应用在个别机器上（相对于整个网络而言），在这些情况中其角色是过滤或限制对一些服务的访问，或阻止用户有意或无意安装的流氓软件对外部的连接。
Its role can also be to filter or limit connections by rogue or poorly programmed software that a user could, willingly or not, have installed. The reliability of this, however, highly depends on the goal of these actions and the integrity of the system itself. This action is not a measurement to prevent potential threats to send data.
 
The Linux kernel embeds the <emphasis>netfilter</emphasis> firewall, which can be controlled from user space with the <command>iptables</command>, <command>ip6tables</command>, <command>arptables</command> and <command>ebtables</command> commands.
Linux内核嵌入了<emphasis>netfilter</emphasis>防火墙，可以通过<command>iptables</command>、<command>ip6tables</command>、<command>arptables</command>和<command>ebtables</command>命令从用户空间进行控制。
<primary><command>iptables</command></primary>
<primary><command>iptables</command></primary>
However, Netfilter iptables commands are being replaced by nftables, which avoids many of its problems. Its design involves less code duplication, and it can be managed with just the <command>nft</command> command. Since Debian <emphasis role="distribution">Buster</emphasis>, the nftables framework is used by default. The commands mentioned before are provided by versions, which use the nftables kernel API, by default. If one requires the “classic“ commands, the relevant binaries can be adjusted using <command>update-alternatives</command>.
然而，Netfilter iptables 命令正在被 nftables 所取代，它避免了许多问题。它的设计涉及到较少的代码重复，而且它可以只用 <command>nft</command> 命令来管理。Debian <emphasis role="distribution">Buster</emphasis> 默认使用 nftables 框架。
<emphasis>TOOLS</emphasis> fwbuilder and ufw
<emphasis>词汇</emphasis> 安全审核
<primary><command>fwbuilder</command></primary>
<primary><command>fwbuilder</command></primary>
<primary><command>ufw</command></primary>
<primary><command>top</command></primary>
Although (destined to) being replaced by nftables, <command>iptables</command> is still widely used and suited for many use-cases. Creating a rule requires an invocation of <command>iptables</command>/<command>ip6tables</command>. Typing these commands manually can be tedious, so the calls are usually stored in a script, so that the same configuration is set up automatically every time the machine boots, or they can be made “persistent“ using <emphasis role="pkg">iptables-persistent</emphasis>.
每次创建规则需要使用 <command>iptables</command>/<command>ip6tables</command>命令。手工输入这些命令是繁琐的，可以将调用存储在脚本中，这样机器每次启动后就可以进行同样的自动配置。脚本可以手工输入，但是也可以使用很有趣的高级工具（例如，<command>fwbuilder</command>）来准备。
A script usually needs to be written by hand. But there are, tools that make it simpler to configure the <emphasis>netfilter</emphasis> firewall, with a graphical representation of the filtering rules. <command>fwbuilder</command> is undoubtedly among the best of them. The rules are created with simple drag-and-drop actions on objects (interfaces, networks, ports, servers, etc.). A few contextual menus can change the condition (negating it, for instance). Then the action needs to be chosen and configured.
 

Loading…

User avatar None

String updated in the repository

  1. Debian Handbook
  2. 14_security
  3. Chinese (Simplified)
However, Netfilter iptables commands are being replaced by nftables, which avoids many of its problems. Its design involves less code duplication, and it can be managed with just the <command>nft</command> command. Since Debian <emphasis role="distribution">Buster</emphasis>, the nftables framework is used by default. The commands mentioned before are provided by versions, which use the nftables kernel API, by default. If one requires the “classic“ commands, the relevant binaries can be adjusted using <command>update-alternatives</command>.
然而，Netfilter iptables 命令正在被 nftables 所取代，它避免了许多问题。它的设计涉及到较少的代码重复，而且它可以只用 <command>nft</command> 命令来管理。Debian <emphasis role="distribution">Buster</emphasis> 默认使用 nftables 框架。
a year ago
Browse all string changes

Things to check

XML markup

XML tags in translation do not match source

Reset

Glossary

English Chinese (Simplified)
default 默认 Debian Handbook
kernel 内核 Debian Handbook

String information

Flags
xml-text
String age
a year ago
Last updated
11 months ago
Source string age
a year ago
Translation file
zh-CN/14_security.po, string 42