Firewalls and nftables

The nftables object model: tables, chains, hooks, rules.

nftables replaces iptables, ip6tables, arptables, and ebtables with a single unified framework. Every piece of policy lives in this hierarchy:

# List the entire current ruleset:
sudo nft list ruleset

# If nothing is configured, output is empty.
# A populated ruleset looks like:
# table inet filter {
#     chain input {
#         type filter hook input priority filter; policy drop;
#         iif "lo" accept
#         ct state established,related accept
#         tcp dport 22 accept
#     }
#     chain forward {
#         type filter hook forward priority filter; policy drop;
#     }
#     chain output {
#         type filter hook output priority filter; policy accept;
#     }
# }

# Object model:
# table  = namespace; family = inet (IPv4+IPv6), ip, ip6, arp, bridge
# chain  = ordered list of rules; attached to a netfilter hook
# hook   = where in the kernel's packet path the chain fires
#          input    = packets destined for this host
#          forward  = packets being routed through this host
#          output   = packets originating from this host
#          prerouting / postrouting = before/after routing decision (for NAT)
# rule   = match + verdict (accept / drop / reject / jump / goto)
# policy = default verdict when no rule matches (accept or drop)

Writing a minimal default-deny inbound ruleset.

# Create a table (inet = applies to both IPv4 and IPv6):
sudo nft add table inet filter

# Add the input chain with default-deny policy:
sudo nft add chain inet filter input \
  '{ type filter hook input priority 0; policy drop; }'

# Rule 1: always accept loopback (lo) traffic — breaking this breaks localhost:
sudo nft add rule inet filter input iif lo accept

# Rule 2: accept established/related connections (return traffic for outbound):
sudo nft add rule inet filter input ct state established,related accept

# Rule 3: accept new SSH connections:
sudo nft add rule inet filter input tcp dport 22 accept

# Rule 4 (optional): accept a web server:
sudo nft add rule inet filter input tcp dport { 80, 443 } accept

# Add output and forward chains (permissive output is typical for a server):
sudo nft add chain inet filter forward \
  '{ type filter hook forward priority 0; policy drop; }'
sudo nft add chain inet filter output \
  '{ type filter hook output priority 0; policy accept; }'

# Verify the full ruleset:
sudo nft list ruleset

The ct state established,related accept rule is critical — without it, your SSH session’s return packets (kernel replies to the client’s TCP segments) are dropped by the default-deny policy, and the connection stalls immediately after the rule is installed.

Persisting nftables rules across reboots.

Rules added with nft add live only in kernel memory. On reboot they vanish.

# Save current ruleset to a file:
sudo nft list ruleset > /etc/nftables.conf

# The file is a valid nft script. Contents will look like:
# #!/usr/sbin/nft -f
# table inet filter {
#     chain input { ... }
#     chain forward { ... }
#     chain output { ... }
# }

# Load a ruleset from a file (replaces current rules):
sudo nft -f /etc/nftables.conf

# Enable the systemd service to load rules at boot:
sudo systemctl enable nftables
sudo systemctl start nftables
# systemd's nftables.service runs: nft -f /etc/nftables.conf at startup

# Test a ruleset file without applying it:
sudo nft -c -f /etc/nftables.conf
# -c = check only, do not load

The nftables.service on Debian/Ubuntu loads /etc/nftables.conf by default. Check the service file if your distro uses a different path: systemctl cat nftables.

firewalld: a higher-level manager over nftables.

On RHEL/Fedora and increasingly on Debian, firewalld provides a zone-based abstraction over nftables (it used to manage iptables; since firewalld 0.6 it targets nftables by default).

# firewalld concepts:
# zone    = a trust level applied to an interface or source address
#           (public, internal, trusted, drop, block, work, home, dmz, external)
# service = a named port/protocol set (ssh = tcp/22, http = tcp/80, etc.)

# Check status:
sudo firewall-cmd --state
# running

# List active zones and their interfaces:
sudo firewall-cmd --get-active-zones
# public
#   interfaces: ens3

# See what is allowed in the public zone:
sudo firewall-cmd --zone=public --list-all
# public (active)
#   target: default
#   interfaces: ens3
#   services: dhcpv6-client ssh

# Permanently allow HTTP (--permanent writes to XML config):
sudo firewall-cmd --zone=public --add-service=http --permanent
sudo firewall-cmd --reload

# Allow a specific port:
sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
sudo firewall-cmd --reload

# Do NOT mix raw nft rules with firewalld — firewalld rebuilds the nftables
# ruleset on reload and will overwrite any rules you added manually.
sudo nft list ruleset | head -5
# table inet firewalld { ... }   ← firewalld owns this table

Reading and debugging an existing ruleset.

# Full ruleset dump — the ground truth:
sudo nft list ruleset

# List just one table:
sudo nft list table inet filter

# List one chain:
sudo nft list chain inet filter input

# Add a rule with a counter to see how many packets match:
sudo nft add rule inet filter input tcp dport 443 counter accept
sudo nft list chain inet filter input
# tcp dport 443 counter packets 847 bytes 51234 accept

# Delete a specific rule by its handle (handle shown with --handle flag):
sudo nft list chain inet filter input --handle
# tcp dport 22 accept  # handle 3
sudo nft delete rule inet filter input handle 3

# Flush (delete all rules in) a chain without removing the chain itself:
sudo nft flush chain inet filter input

# Delete an entire table:
sudo nft delete table inet filter