Creating Your First Nftables Rule

Creating your first Nftables rule can be an exciting journey into the world of network security and traffic filtering. In this guide, we'll walk you through the essentials of setting up your first rule, including filtering traffic, understanding rule syntax, and applying your rule effectively. By the end of this article, you should feel comfortable creating simple rules to manage your network traffic using Nftables.

Understanding the Basics

Before diving into creating your first rule, it's essential to understand a few basic concepts related to how Nftables operates:

Tables: Nftables uses tables to organize rules. Each table consists of chains, which contain the actual rules.
Chains: Chains are sequences of rules. There are different types of chains – input (for incoming traffic), output (for outgoing traffic), and forward (for traffic that is routed through the device).
Rules: Rules determine the action taken on packets that match certain criteria. Actions can include allowing, dropping, or rejecting packets.

Now that you have a grasp of Nftables' structure, let's jump into creating your first rule.

Step 1: Install Nftables

Before creating rules, you must have Nftables installed on your Linux system. Many modern distributions come with Nftables pre-installed. To check whether it's installed, run the following command in your terminal:

nft --version

If you see the version number, you’re ready to go! If it’s not installed, you can typically install it with your package manager. For example, on Debian or Ubuntu:

sudo apt update
sudo apt install nftables

Step 2: Create a Nftables Table

To create your first rule, we’ll need to define a table first. Let’s call it filter, which is a common name for tables that handle traffic filtering.

Open your terminal and run:

sudo nft add table ip filter

You should receive no output if the command was successful. You can confirm the table was created by checking the current tables:

sudo nft list tables

You should see your newly created filter table in the list.

Step 3: Create Chains

Next, we need to create chains within our table. For this example, we’ll create an input chain to filter incoming traffic.

Run the following command to add the chain:

sudo nft add chain ip filter input { type filter hook input priority 0; }

This command sets up an input chain for our filter table and defines it as a type of filter with a specific hook.

You can verify that the chain was created successfully:

sudo nft list chains ip filter

Step 4: Creating Your First Rule

Now we can define our first rule! Let's create a rule that drops all incoming traffic from a specific IP address, for example, 192.168.1.100.

To add the rule, run:

sudo nft add rule ip filter input ip saddr 192.168.1.100 drop

Here’s what this command does:

ip filter input specifies the chain where the rule will be added.
ip saddr 192.168.1.100 checks for packets that originate from the IP address 192.168.1.100.
drop is the action taken on those packets, which, in this case, means they will be discarded.

You can now verify that your rule has been added:

sudo nft list ruleset

This command will show you the entire ruleset, including the rules you’ve just created.

Step 5: Applying Changes and Testing

After creating the necessary rules, it’s essential to apply your changes. The good news is that Nftables applies rules in real-time as you configure them, so there’s no need for a separate apply command.

To test if the rule is working, try to ping the server from the IP address 192.168.1.100 or from a device on the same network. You should see that the packets are dropped, indicating that your rule is functioning correctly.

Step 6: Managing Your Rules

It's crucial to have a good grasp of how to manage your rules. Nftables provides several commands to do this:

List all rules: To see all your existing rules, use the command:
```
sudo nft list ruleset
```
Delete a rule: If you need to remove a rule, use the following syntax:
```
sudo nft delete rule ip filter input handle <handle-number>
```
You can find the handle number from the output of your current ruleset.
Flush a table: To clear all rules from a specific table:
```
sudo nft flush table ip filter
```

Additional Tips

Logging: If you want to log dropped packets for analysis, you can add an additional rule before the drop rule:
```
sudo nft add rule ip filter input ip saddr 192.168.1.100 log prefix "Dropped Packet: "
```
Saving Your Rules: To persist your rules across reboots, you’ll want to save your ruleset. On many distributions, this is done using:
```
sudo nft list ruleset > /etc/nftables.conf
```
Make sure to configure your system to load the ruleset on boot.
Reviewing Documentation: While this article covers basic rule creation, Nftables has extensive documentation that provides deeper insights into advanced configuration options.

Conclusion

Congratulations! You’ve just created your first Nftables rule to filter traffic. With this foundational knowledge, you can explore more advanced configurations, manage complex rulesets, and enhance the security of your network.

Nftables opens up a world of possibilities in traffic management and security, and applying what you’ve learned here is just the beginning. So, continue experimenting, refine your skills, and secure your network with confidence!

Networking & Infrastructure - Nftables