我需要在 C++ 程序中控制进出 Linux 机器的入站和出站流量。我可以从我的程序中调用 iptables，但我更愿意去掉中间人并自己访问内核 API 函数。
我相信我需要使用 libnfnetlink，但是，我找不到任何 API 文档或示例程序。
我需要构建的规则相当简单 - 例如丢弃目标端口等于 X 的数据包等。我不打算编写完整的防火墙应用程序。
谁能提出更好的方法，或者提供一些文档或示例应用程序的链接？我宁愿避免阅读 iptables 代码，但我想如果我找不到更好的资源，我可能不得不这样做。
I need to control inbound and outbound traffic to/from a linux box from within a C++ program. I could call iptables from within my program, but I'd much rather cut out the middle man and access the kernel API functions myself.
I believe I need to use libnfnetlink, however, I have not been able to find any API documentation or example programs.
The rules I need to construct are fairly simple - things like dropping packets with a destination port equal to X etc. I do NOT intend to write a full firewall application.
can anyone suggest a better approach, or provide a link to some documentation or example apps? I'd rather avoid reading the iptables code, but i guess I may have to, if I can't find any better resources.
发布评论
评论（4）
一年前，我有同样的要求并进行了探索。但在联系了一些开源内核人员后，我了解到 -
iptables 的内核 API 不是外部化的，也就是说，它们不是记录在案的 API。从某种意义上说，API 随时都可能发生变化。它们只能由 iptables 工具使用。应用程序开发人员不应使用它们。
-萨蒂什
An year back I was having the same requirement and probed around. But after contacting some open source kernel guys this is what I came to know -
The kernel APIs of iptables are not externalised, means to say, they are not documented APIs. In the sense, the APIs can change any moment. They should be used only by the iptables tool. they should not be used by the application developers.
-satish
您通常不需要定期（即在运行时频繁）更改 IP 表规则。因此调用 /sbin/iptables 应该没问题。
如果您尝试这样做，那么您可能需要查看包含其自己的智能的替代匹配或目标模块，或者使用 NFQUEUE 将数据包排队到用户空间程序中，该程序可以根据可以的标准做出自己的决定尽可能频繁地更改（注意不要向用户空间发送太多数据包，这是潜在的性能问题）
You should not normally need to change IP tables rules on a regular basis (i.e. frequently at runtime). Therefore calling /sbin/iptables should be fine.
If you're trying to do this, then probably you need to look at an alternative match or target module which contains its own intelligence, or use NFQUEUE to queue the packets into a userspace program which can make its own decision based on criteria which can change as often as it likes (beware of sending too many packets into userspace, it's a potential performance problem)
为什么不直接获取 iptables 的源代码并像他们那样做呢？由于它是开源的......
Why not just get the source to iptables and do it like they do it? Since it is open source....
在跨平台网络中（
https://bitbucket.org/ptroen/crossplatformnetwork/）我编写了一个非常优雅的 IPTables 防火墙包装器您可以在其中通过 JSON（最多两个不同的网卡）控制防火墙。来源在这里：
https://bitbucket.org/ptroen /crossplatformnetwork/src/master/Tools/FirewallScript/FirewallScript.cc
在此处创建文件：https://bitbucket.org/ptroen/crossplatformnetwork/src/master/Tools/FirewallScript/FirewallScript.make
请注意，如果您的文件系统中没有 json 文件，它会为您生成一个当你第一次运行它时。
其余的源代码位于此文件夹中：
https://bitbucket.org/ptroen/crossplatformnetwork/src/master/OSManagement /Firewall/
我在最后的运行报告中也做了一些评论：
https:// bitbucket.org/ptroen/crossplatformnetwork/src/master/Cross%20Platform%20High%20Concurrent%20Network%20Framework%20Final%20Report.pdf
我将粘贴您可能需要处理的内容以使其正常工作：
sudo systemctl 停止防火墙
sudo systemctl 禁用防火墙
安装 iptables 服务
sudo dnf iptables-服务
启动iptables服务
systemctl 启动 iptables.service
sudo systemctl 重新启动 iptables
sudo iptables -L 检查
唯一的构建依赖项是 boost C++。
In cross platform network(
https://bitbucket.org/ptroen/crossplatformnetwork/) I wrote a very elegant IPTables firewall wrapper where you can control the firewall via JSON(up to two different nics). The source is here:
https://bitbucket.org/ptroen/crossplatformnetwork/src/master/Tools/FirewallScript/FirewallScript.cc
Make File here: https://bitbucket.org/ptroen/crossplatformnetwork/src/master/Tools/FirewallScript/FirewallScript.make
Note if their no json file in your filesystem it will generate one for you when you run it the first time.
and the rest of the source is in this folder:
https://bitbucket.org/ptroen/crossplatformnetwork/src/master/OSManagement/Firewall/
I also made some remarks in the final report on the operation:
https://bitbucket.org/ptroen/crossplatformnetwork/src/master/Cross%20Platform%20High%20Concurrent%20Network%20Framework%20Final%20Report.pdf
I'll just paste what you may have to deal with to get it working:
sudo systemctl stop firewalld
sudo systemctl disable firewalld
install iptables services
sudo dnf iptables-services
start the iptables service
systemctl start iptables.service
sudo systemctl restart iptables
sudo iptables -L to inspect
The only build dependencies is boost C++.