更新 防火墙.MD

防火墙.MD

@@ -119,17 +119,43 @@ nft list ruleset
 > nftables **不能直接用 ipset 命令**，ipset 是 iptables 的组件。需要脚本把 APNIC 网段导入 nftables set。
 
 新建脚本 `/usr/local/bin/update-cn-set.sh`
-
 ```
+cat > /usr/local/bin/update-cn-set.sh <<'EOF'
 #!/bin/bash
 TMP=$(mktemp)
-curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest > $TMP
+curl -s https://ftp.apnic.net/stats/apnic/delegated-apnic-latest > "$TMP"
 
+# 清空集合
 nft flush set ip filter cn_ip
-awk -F'|' '$2=="CN"&&$3=="ipv4"{len=32-log($5)/log(2);print "add @cn_ip " $4 "/" len}' $TMP | nft -f -
-rm -f $TMP
+
+# 生成 nftables 合法 add element 语法
+awk -F'|' '$2=="CN"&&$3=="ipv4"{
+    len=32 - log($5)/log(2);
+    printf "add element ip filter cn_ip { %s/%d }\n", $4, len
+}' "$TMP" | nft -f -
+
+rm -f "$TMP"
+EOF
+chmod +x /usr/local/bin/update-cn-set.sh
 ```
 
+```
+cat > /usr/local/bin/update-cn-set.sh <<'EOF'
+#!/bin/bash
+TMP=$(mktemp)
+curl -s https://raw.githubusercontent.com/misakaio/chnroutes2/master/chnroutes.txt > "$TMP"
+
+nft flush set ip filter cn_ip
+
+while read -r net; do
+    [[ -z "$net" || "$net" =~ ^# ]] && continue
+    nft add element ip filter cn_ip { "$net" }
+done < "$TMP"
+
+rm -f "$TMP"
+EOF
+chmod +x /usr/local/bin/update-cn-set.sh
+```
 赋予执行权限：
 
 ```