#nftables

Replaces iptables. Use for all new Linux deployments.

#Default Deny Configuration

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif lo accept
        # specific allow rules here
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy drop;
        ct state established,related accept
        # explicit egress rules here
    }
}

Egress filtering on output is critical and almost universally neglected. Malware, data exfil, and C2 all depend on unrestricted outbound access. Whitelist only ports/destinations your system actually needs.

#Key Concepts

• Stateful inspection: ct state established,related
• Sets and maps: efficient matching against large lists
• Deep packet inspection: Layer 7 content inspection
• Geo-IP blocking: via sets with IP ranges
• Rate limiting: per-address connection limits
• Connection tracking: ct state tracking

#References

• Complete guide: https://medium.com/@ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c
• Layer 7: https://www.linuxoperatingsystem.net/nftables-layer-7-security/
• Arch sample script: https://bbs.archlinux.org/viewtopic.php?id=289072
• Red Hat getting started: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables
• Default deny: https://access.redhat.com/solutions/7049833