Lesson 3.8: nftables: default deny for inbound traffic

nftables is the Linux kernel's packet filter (the successor to iptables) and the engine under ufw and firewalld on many systems. A ruleset is made of tables, chains attached to hooks such as input, and rules evaluated in order; a chain's policy decides what happens to everything no rule accepted. In the lab you look at web03's permissive ruleset and its consequence (database and cache reachable from the internet), check a stricter draft and fix its syntax error before it can lock anyone out, load it, and verify from the outside and with counters.

17 min

You will learn to

Explain tables, chains, hooks, rules and policies
Read a ruleset with nft list
Check a file with nft -c before loading
Write a default-deny input chain
Verify with a scan and with counters

Key terms

Table: A container for chains and sets, with a family (ip, ip6, inet for both, arp, bridge, netdev).
Base chain and hook: A chain attached to a point in the packet path: input (to this host), output (from it), forward (through it).
Policy: The verdict for packets that reach the end of a base chain.
Connection tracking (ct state): The kernel remembers connections, so replies (established, related) can be accepted with one rule.
Verdict: accept, drop (silently) or reject (with an error back).
Counter: A rule statement that counts matching packets and bytes.

← Subnets and CIDR: dividing a network · All lessons · sudo rules that give away root →