Configuring a firewall
nftables tables, chains and hooks, default policy, connection tracking, address translation and port forwarding, logging, and the safe order of a ruleset.
- 24 cards
- 3 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
A few cards from the deck
nftables: what is it?
Show the answer
The Linux kernel's packet filtering framework, driven by the nft command, which puts its rules into chains, themselves grouped into tables.
A table groups chains of one family (ip, ip6, inet); a base chain is hooked to a point on the packets' path and holds the rules.
Since this ruleset was loaded, the server gets no reply to its own requests (updates, DNS). Which rule must be added to the chain?
```nft
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
iif lo accept
tcp dport 22 accept
}
}`ct state established,related acceptudp dport 53 accepttcp dport { 80, 443 } acceptct state new accept
Show the answer
ct state established,related acceptRequests leave freely, but their replies enter through
input, where the policy drops them. A reply arrives on the server's ephemeral port, not on 53, 80 or 443, and it is not a new connection: only the state rule accepts whatever answers an already allowed exchange, without opening a port.The … chain sees packets addressed to the machine itself, … those it emits, and … those it merely relays.
Show the answer
The input chain sees packets addressed to the machine itself, output those it emits, and forward those it merely relays.
A filtering router protects its network mostly in
forward;inputprotects only itself. Relaying also requires enablingnet.ipv4.ip_forward.iptables: what is it?
Show the answer
The older Linux kernel filtering command, which nftables replaces, with fixed tables and chains (filter, nat).
It is still found everywhere, sometimes as a front end to nftables. The concepts (INPUT, FORWARD, OUTPUT chains, connection tracking) are the same, the syntax differs.
In this chain, an administrator adds
tcp dport 22 acceptat the end. Can they connect over SSH?
```nft
table ip filter {
chain input {
type filter hook input priority 0; policy accept;
ip saddr 0.0.0.0/0 drop
}
}`- Yes, an
acceptrule always overrides adrop - No, the
droprule before it has already dropped the packet - Yes, because the chain's policy is
accept - Yes, but only for packets already seen in an established connection
Show the answer
No, the
droprule before it has already dropped the packetRules are read in order and the first one matching with a final verdict applies. Here the
dropmatches every source and the SSH rule is never reached; the policy only applies if no rule picks the packet.- Yes, an