IntermediateNetworking & Security
Modern Linux Firewall: nftables Hardening
Migrate from iptables to nftables. This recipe provides a clean, atomic, and high-performance firewall configuration to protect internet-facing servers.
nftablesLinux
Prerequisites
- Linux Kernel 3.13+
- nftables installed
Configuration Files
nftables.conf/etc/nftables.conf
flush ruleset\ntable inet filter {\n chain input {\n type filter hook input priority 0; policy drop;\n ct state established,related accept\n iif "lo" accept\n tcp dport { 80, 443 } accept\n tcp dport 22 limit rate 5/minute accept\n }\n}Explanation:Drops all incoming traffic by default, allows established connections, local loopback, HTTP/HTTPS, and rate-limits SSH.
Verification Steps
1
Displays the currently active ruleset in the kernel.
$nft list ruleset
Expected Outputtable inet filter { ... }
Production Gotchas
- A misconfigured default drop policy can instantly lock you out of SSH. Always run a temporary test script or ensure console access.
Frequently Asked Questions
Why is nftables better than iptables?
It offers a simpler syntax, atomic rule updates (no partial loading), and better performance via unified IPv4/IPv6 handling.