Nftables Firewall Setup Linux

nftables firewall setup linux

Many of you might have utilized Iptables before and likely

encountered its cumbersome nature:

• Hard-to-read rules
• Lack of a streamlined method to persist rules across reboots
• Generally messy scripting using shell scripts
Fortunately, there exists a superior alternative to Iptables – nftables,
abbreviated as “nft” (though the abbreviation hasn’t aged well).
Despite its simplicity and user-friendliness, surprisingly few
individuals are acquainted with it.
In this tutorial, we will demonstrate the setup of a straightforward
firewall that permits all outgoing ports along with incoming HTTP,
HTTPS, SSH, and DNS traffic.

Prerequisites:
You’ll need any Linux distribution that supports nftables, which
encompasses virtually any Linux distribution updated within the last
decade.
For Debian and Ubuntu users, install the nftables package:
sudo apt install nftables
Ensure that no frontends like UFW are active. To deactivate UFW,
execute the following command:
sudo ufw disable
You can verify their status using nft --version and sudo ufw status.
Example Terminology:
Main network interface: enp5s0
Step 1 – Accessing the Configuration

File:
Most distributions contain
either /etc/nftables.conf or /etc/sysconfig/nftables.conf. Open the relevant file
using your preferred text editor:

sudo editor /etc/nftables.conf
Step 2 – Removing the Skeleton:

The file may either be empty or contain the following structure:
#!/usr/sbin/nft -f
flush ruleset
table inet filter {

chain input {
type filter hook input priority filter;
}
chain forward {
type filter hook forward priority filter;
}
chain output {
type filter hook output priority filter;
}
}
If this is the case, clear the file before proceeding. Otherwise, if the
file contains existing rules, handle them accordingly. However,
ensure not to delete any crucial rules, especially those pertaining to
virtualization.
READ MORE Exciting News: Launching High-Powered Dedicated Servers in
Germany!
Step 3 – Crafting the Firewall
Configuration:
Below is a template that can be pasted into the configuration file:
#!/usr/sbin/nft -f
# Variables
define main_interface = "enp5s0"
# Delete previous table

table ip my_filter
delete table ip my_filter
# Create new table

table ip my_filter {
# Filter ingoing traffic
chain input {
type filter hook input priority 0;
iifname $main_interface tcp dport {22, 80, 443} accept

iifname $main_interface udp dport 53 accept
iifname $main_interface ip protocol icmp accept # Accept all ICMP traffic
iifname $main_interface ct state established,related accept # Accept any input traffic originated
from us
iifname $main_interface ct state invalid drop # Drop invalid packets...
iifname $main_interface icmpv6 type {echo-request,nd-neighbor-solicit} accept # Accept IPv6
neighbour discovery
iifname $main_interface drop # Drop everything else
}
# Drop all packages to be forwarded (we're not a gateway!)

chain forward {
type filter hook forward priority 0; policy drop;
}
# Allow all outgoing traffic

chain output {
type filter hook output priority 0; policy accept;
}
}
Step 3.1 – Customizing the

Configuration File:
Replace enp5s0 with your public-facing network interface. For
multiple interfaces, specify them as follows:
define main_interface = {"enp5s0", "enp7s0"}
Adjust the port configurations according to your requirements:
iifname $main_interface tcp dport {22, 80, 443} accept

iifname $main_interface udp dport 53 accept
Note that port ranges can be specified using {}. If UDP ports aren’t
required, the entire line can be omitted.
Port ranges can also be specified like so:
iifname $main_interface udp dport {53, 1000-1999} accept
Step 3.2 – Allowing Forwarding to

Bridges (Optional):
If bridge networking for virtual machines is in use, forwarding to
those bridges must be permitted. Add the following rule to the end
of the forward chain for each bridge interface (replace br0 with your
bridge interface):
iifname $main_interface oifname "br0" accept
Uncomment the line above the chain.

Step 4 – Applying the Firewall Rules:
Make the configuration file executable:
sudo chmod a+x /etc/nftables.conf
Execute the configuration file:
sudo /etc/nftables.conf
You can repeat this step whenever modifications to the rules are
necessary. The rules will also be applied automatically upon
rebooting.
READ MORE From Blog to Online Empire: A Journey with Dedicated Servers
Step 5 – Troubleshooting:
If connectivity issues arise, consider disabling the firewall
temporarily. For cloud servers, use the cloud web interface and
execute:
sudo nft delete table ip my_filter

For dedicated servers, utilize KVM or reboot into the rescue system
via the SarvHost Robot web interface to manually delete the firewall
configuration.
If the firewall configuration seems ineffective, ensure
that main_interface corresponds to the public-facing network
interface.
Conclusion:
You’ve successfully established a modern and efficient firewall using
nftables. Refer to the nftables wiki for additional insights and
information.
For order Dedicated server – vps – Web hosting – domain >>
www.sarvhost.com

Nftables Firewall Setup Linux

Uploaded by

Copyright:

Available Formats

Nftables Firewall Setup Linux

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Nftables Firewall Setup Linux

Uploaded by

Copyright:

Available Formats

nftables firewall setup linux

Many of you might have utilized Iptables before and likely

encountered its cumbersome nature:

• Lack of a streamlined method to persist rules across reboots

• Generally messy scripting using shell scripts

Fortunately, there exists a superior alternative to Iptables – nftables,

abbreviated as “nft” (though the abbreviation hasn’t aged well).

Despite its simplicity and user-friendliness, surprisingly few

individuals are acquainted with it.

In this tutorial, we will demonstrate the setup of a straightforward

HTTPS, SSH, and DNS traffic.

encompasses virtually any Linux distribution updated within the last

For Debian and Ubuntu users, install the nftables package:

sudo apt install nftables

Ensure that no frontends like UFW are active. To deactivate UFW,

execute the following command:

sudo ufw disable

Main network interface: enp5s0

Step 1 – Accessing the Configuration

either /etc/nftables.conf or /etc/sysconfig/nftables.conf. Open the relevant file

using your preferred text editor:

Step 2 – Removing the Skeleton:

table inet filter {

file contains existing rules, handle them accordingly. However,

ensure not to delete any crucial rules, especially those pertaining to

READ MORE Exciting News: Launching High-Powered Dedicated Servers in

# Delete previous table

# Create new table

iifname $main_interface tcp dport {22, 80, 443} accept

# Drop all packages to be forwarded (we're not a gateway!)

# Allow all outgoing traffic

Step 3.1 – Customizing the

multiple interfaces, specify them as follows:

define main_interface = {"enp5s0", "enp7s0"}

Adjust the port configurations according to your requirements:

iifname $main_interface tcp dport {22, 80, 443} accept

required, the entire line can be omitted.

Port ranges can also be specified like so:

iifname $main_interface udp dport {53, 1000-1999} accept

Step 3.2 – Allowing Forwarding to

Uncomment the line above the chain.

sudo chmod a+x /etc/nftables.conf

Execute the configuration file:

necessary. The rules will also be applied automatically upon

sudo nft delete table ip my_filter

If the firewall configuration seems ineffective, ensure

that main_interface corresponds to the public-facing network

You’ve successfully established a modern and efficient firewall using

nftables. Refer to the nftables wiki for additional insights and

For order Dedicated server – vps – Web hosting – domain >>

You might also like