From e717d66dc38e95405afd38791cf61581680e84b6 Mon Sep 17 00:00:00 2001
From: salem <77879189@qq.com>
Date: Sun, 6 Sep 2026 22:27:59 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20=E9=98=B2=E7=81=AB?=
 =?UTF-8?q?=E5=A2=99.MD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 防火墙.MD | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/防火墙.MD b/防火墙.MD
index a146994..4f865f1 100644
--- a/防火墙.MD
+++ b/防火墙.MD
@@ -119,17 +119,43 @@ nft list ruleset
 > nftables **不能直接用 ipset 命令**，ipset 是 iptables 的组件。需要脚本把 APNIC 网段导入 nftables set。
 
 新建脚本 `/usr/local/bin/update-cn-set.sh`
-
 ```
+cat > /usr/local/bin/update-cn-set.sh <<'EOF'
 #!/bin/bash
 TMP=$(mktemp)
-curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest > $TMP
+curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest > "$TMP"
 
+# 清空集合
 nft flush set ip filter cn_ip
-awk -F'|' '$2=="CN"&&$3=="ipv4"{len=32-log($5)/log(2);print "add @cn_ip " $4 "/" len}' $TMP | nft -f -
-rm -f $TMP
+
+# 生成 nftables 合法 add element 语法
+awk -F'|' '$2=="CN"&&$3=="ipv4"{
+    len=32 - log($5)/log(2);
+    printf "add element ip filter cn_ip { %s/%d }\n", $4, len
+}' "$TMP" | nft -f -
+
+rm -f "$TMP"
+EOF
+chmod +x /usr/local/bin/update-cn-set.sh
 ```
 
+```
+cat > /usr/local/bin/update-cn-set.sh <<'EOF'
+#!/bin/bash
+TMP=$(mktemp)
+curl -s https://raw.githubusercontent.com/misakaio/chnroutes2/master/chnroutes.txt > "$TMP"
+
+nft flush set ip filter cn_ip
+
+while read -r net; do
+    [[ -z "$net" || "$net" =~ ^# ]] && continue
+    nft add element ip filter cn_ip { "$net" }
+done < "$TMP"
+
+rm -f "$TMP"
+EOF
+chmod +x /usr/local/bin/update-cn-set.sh
+```
 赋予执行权限：
 
 ```