Advanced Firewall Rules (nftables)

Welcome to nftables, the modern packet filtering framework for Linux! It's designed to be more flexible and easier to use than its predecessor, iptables.

While iptables uses separate tools for IPv4, IPv6, and bridging, nftables provides a unified syntax. This means you can manage all your firewall rules with a single command-line utility: nft.

nftables organizes rules into a clear hierarchy:

• Families: Define the network layer (e.g., ip for IPv4, ip6 for IPv6, bridge for Layer 2, netdev for Layer 1/2).
• Tables: Containers for chains, belonging to a specific family. You can have multiple tables.
• Chains: Sequences of rules that packets are evaluated against. Chains can be "base chains" (entry points for kernel hooks) or "regular chains" (called by other chains).

To see the current nftables ruleset on your system, you use the nft list ruleset command. If you're just starting, it might be empty or contain default rules.

Let's take a look:

Before adding rules, we need a table and a chain. A common practice is to create a table for the ip family (IPv4) and a base chain named input for incoming traffic.

We'll set the default policy for this chain to drop, meaning any packet not explicitly allowed will be discarded. This is a secure "deny by default" approach.

Now that our input chain drops everything by default, we need to add rules to allow necessary traffic. A common first step is to permit inbound SSH connections (port 22) so you can manage your server remotely.

We'll also allow established and related connections to ensure ongoing communication works, which is crucial for most network interactions.

Most systems need to initiate outbound connections (e.g., to fetch updates, browse the web). We typically create an output base chain.

For simplicity, let's create an output chain and allow all outgoing IPv4 traffic. In production, you might restrict this more tightly.

Network Address Translation (NAT) allows multiple devices on a private network to share a single public IP address. Source NAT (SNAT) changes the source IP of outgoing packets.

This is commonly used on routers to allow internal clients to access the internet. Here, we set up a basic SNAT rule for traffic going out through eth0, masquerading it with the public IP of eth0.

Destination NAT (DNAT), also known as port forwarding, changes the destination IP address and/or port of incoming packets. This allows external users to access services on an internal server.

For example, you might forward external port 80 to an internal web server at 192.168.1.5 on port 80. This rule would be placed in the prerouting chain.

Rules added with nft directly on the command line are temporary and will be lost after a reboot. To make them permanent, you need to save them to a configuration file.

The standard way is to save the current ruleset to /etc/nftables.conf and ensure the nftables service is enabled to load it on boot. You can then restore them with nft -f /etc/nftables.conf.

You've learned about nftables structure and basic rules. Let's test your understanding.

Great job! You've taken your first steps with nftables, the powerful and flexible successor to iptables.

• You learned about its unified structure using families, tables, and chains.
• You practiced adding basic filter rules for inbound and outbound traffic.
• You explored configuring Source NAT (SNAT) and Destination NAT (DNAT).
• Finally, you understood how to save your rules for persistence across reboots.

Keep experimenting with nftables to secure and manage your Linux network!