使用 nftables 配置 Linux 防火墙

A host firewall decides which packets are allowed in or out of a single machine. It is your last line of defense, protecting services even when the network perimeter is breached.

Modern Linux uses nftables as the kernel packet-filtering framework, replacing the older iptables. It uses tables, chains, and rules but with a cleaner, unified syntax.

In nftables a table holds chains, a chain holds ordered rules, and each rule matches packets and takes an action like accept or drop. Chains hook into traffic at points such as input and output.

See the entire active configuration with a single command. This is always your first step before changing anything.

Create a table and an input chain with a default drop policy, then allow only what you need. Default-deny is the secure baseline.

Add a rule to accept incoming TCP on port 22 so you do not lock yourself out before allowing anything else.

Permit replies to connections you initiated by accepting established and related traffic. Without this, outbound requests get no responses.

For everyday use, ufw (Uncomplicated Firewall) is a friendly front-end. It manages the underlying rules with simple commands.

Verify which rules ufw has applied and whether it is active.

nftables rules added at the command line vanish on reboot. Save them to /etc/nftables.conf and enable the service so they reload automatically.

Add a logging rule before the final drop so you can see what is being blocked. This is invaluable when a service mysteriously cannot be reached.

Test your firewall knowledge.

You learned to configure the Linux firewall.

• nftables uses tables, chains, and rules with a default-deny baseline.
• Always allow SSH and established traffic before locking down.
• ufw simplifies common rules; persist nftables to survive reboots.