查看“︁使用nftables屏蔽国外流量”︁的源代码

----

=== 1. 准备 ===
确保 nftables 与 python3 已经安装<syntaxhighlight>
nft --version
python3 --version
</syntaxhighlight>若没有安装, 以Debian13为例<syntaxhighlight>apt update
apt install nftables python3 unzip
systemctl enable nftables</syntaxhighlight>拷贝原有的nftables配置, 到一个好找的目录里, 以 <code>/main/nftables</code> 为例, 再对原路径进行链接<syntaxhighlight>cp /etc/nftables.conf /main/nftables/
ln -f /main/nftables/nftables.conf /etc/nftables.conf</syntaxhighlight>并准备好编辑 <code>/main/nftables/nftables.conf</code>

=== 2. 获取国内IP段 ===
先获取并解压项目文件<syntaxhighlight>
mkdir /main/nftables/geoip
cd /main/nftables/geoip
wget https://github.com/pvxe/nftables-geoip/archive/refs/heads/master.zip
unzip master.zip
rm master.zip
</syntaxhighlight>执行脚本<syntaxhighlight>mv nftables-geoip-master/* ./
chmod u+x nft_geoip.py
./nft_geoip.py --file-location location.csv --download
./nft_geoip.py --download -c cn</syntaxhighlight>

=== 3. 配置nftables ===
在合适位置添加或与其它的table进行合并, 这里比如只有访问tcp 46端口的国内IP, 才能放行<syntaxhighlight line="1">
table inet geoip_filter {

    include "/main/nftables/geoip/geoip-def-all.nft";
    include "/main/nftables/geoip/geoip-ipv4-interesting.nft";
	include "/main/nftables/geoip/geoip-ipv6-interesting.nft";

    chain geoip_mark_input {
		type filter hook                        prerouting priority -10;
        policy accept;


		meta mark set                           ip saddr map @geoip4;
		meta mark set                           ip6 saddr map @geoip6;
	}

    chain input {
        type filter hook input priority 0;
        policy drop;

        # 放行本地/已建立/相关的连接
        iif lo accept;
        ct state established,related        accept;
        
        tcp dport { 46 }    meta mark $CN   ct state new    accept;
    }
}
</syntaxhighlight>

=== 4. 完成配置 ===
保存后并重启<syntaxhighlight>
systemctl restart nftables.service
</syntaxhighlight>