# nftables

Replaces iptables. Use for all new Linux deployments.

## Default Deny Configuration

```
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif lo accept
        # specific allow rules here
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy drop;
        ct state established,related accept
        # explicit egress rules here
    }
}
```

Egress filtering on output is critical and almost universally neglected. Malware, data exfil, and C2 all depend on unrestricted outbound access. Whitelist only ports/destinations your system actually needs.

## Key Concepts

- **Stateful inspection**: ct state established,related
- **Sets and maps**: efficient matching against large lists
- **Deep packet inspection**: Layer 7 content inspection
- **Geo-IP blocking**: via sets with IP ranges
- **Rate limiting**: per-address connection limits
- **Connection tracking**: ct state tracking

## References

- Complete guide: https://medium.com/@ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c
- Layer 7: https://www.linuxoperatingsystem.net/nftables-layer-7-security/
- Arch sample script: https://bbs.archlinux.org/viewtopic.php?id=289072
- Red Hat getting started: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables
- Default deny: https://access.redhat.com/solutions/7049833