Firewalling with nftables
You build tables, chains, sets and maps with nftables, Linux’s modern packet filtering framework, and write stateful firewalls for a server and a gateway.
Level 301 · 16 lessons · 18 practice labs
Lessons
Basics
- nftables architecture: families, tables, chains, hooks
- A first ruleset: default deny and connection tracking
- Writing a ruleset file and loading it atomically
- Translating iptables rules to nftables
- Short task: write a ruleset for a web server from scratch
Advanced structures
- Sets and maps: managing thousands of addresses with one rule
- Dynamic sets and rate limits: slowing down brute force
- Counters and logging: which rule caught what
- Loading threat lists into a set
- Short task: block addresses making more than 10 SSH attempts a minute
Gateway
- The forward chain: filtering between two networks
- NAT and port forwarding
- Egress policy: only the destinations you need
- Testing the ruleset and having a rollback plan
- Short task: allow only DNS and HTTPS out of the internal network
Capstone
- Capstone: build a three-zone gateway firewall
Practice labs
- Write a first nftables ruleset with default deny: Create an input chain in an inet table, allow established connections and SSH and test ports from outside.
- Translate iptables rules to nftables and prove they match: Translate the rules with iptables-translate, tidy them and show the same test packets get the same result.
- Load the ruleset atomically and roll back on error: Catch a faulty change with nft -c, load it with a rollback timer and show your connection survives.
- Manage blocked addresses with a set: Create a named set, add three addresses and show a single rule blocks them all.
- Slow down anyone making more than ten SSH attempts a minute: Build a rate limit with a dynamic set and meter and show the fast-guessing address lands in the set.
- Load a threat list from a file into a set: Convert a list of thousands of lines into set format, load it and count matching packets with a counter.
- Show which rule caught what using counters: Add a counter and log prefix to each rule, generate traffic and find an unexpected rule that fired.
- Forward only web traffic between two networks: Set default deny in the forward chain, allow only 80 and 443 and test the other ports.
- Set up source NAT and destination NAT together: Add masquerading for the internal network and port forwarding to an internal server and test both directions.
- Allow only DNS and HTTPS out of the internal network: Write the egress policy and show SSH and SMTP attempts from a client fail while the web works.
- Test the ruleset and execute the rollback plan: Validate the new gateway rules against a test list and show the automatic return to the previous set when one fails.
- Close the leak between the management and internal networks: Find unwanted access between two zones from flow records and prove the fix by correcting the forward rules.
- Drop invalid packets with connection tracking: Add a ct state invalid rule, test with crafted packets and show the dropped packets in the counter.
- Read the output chain and write down what it allows: Find the default policy of the output chain and the three permitted destinations in a given ruleset and explain them in plain sentences.
- Add the rule that accepts established connections: Add a rule accepting established and related states in the right position of a default-drop input chain and show outbound connections get replies.
- Find and limit the traffic that fills the connection tracking table: Identify from the conntrack counters the source filling the table, write a meter rule limiting new connections per source and measure that legitimate traffic is unaffected.
- Read a set’s elements and counters: Show the number of addresses in the block set, the elements with a timeout and the rule’s packet counter.
- Update a threat list atomically without interruption: Use an interval set with auto-merge, write a scheduled script that swaps the list in one transaction and prove protection does not lapse during the update.
About this course
You build tables, chains, sets and maps with nftables, Linux’s modern packet filtering framework, and write stateful firewalls for a server and a gateway.
What you will learn
- Basics
- Advanced structures
- Gateway
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.