Using the Nft Command-Line Tool

In this article, we’ll dive straight into effectively using the nft command-line tool to manage your Nftables rules and configurations. Whether you're a seasoned network administrator or an enthusiastic newcomer to network security, understanding how to interact with Nftables through the nft command is crucial for optimizing your firewall settings and improving overall network performance.

Setting Up Nftables

Before diving into the nft commands, ensure that Nftables is installed on your system. Most modern Linux distributions come with Nftables pre-installed, but it's always good to check. You can verify this by running:

nft --version

If you see the version number, you’re all set. If not, you might need to install it via your package manager. For Debian-based systems, the command would be:

sudo apt update
sudo apt install nftables

For Red Hat-based systems:

sudo yum install nftables

Once installed, ensure that the service is enabled to start on boot:

sudo systemctl enable nftables
sudo systemctl start nftables

Basic Nft Command Syntax

The basic syntax of the nft command is as follows:

nft <options> <command> [<type> <name>] [<arguments>...]

• <options>: Various options for the command execution.
• <command>: The action you want to take (e.g., add, delete, list).
• <type> <name>: This specifies which table or chain you are working with.
• <arguments>: Any additional parameters that the command requires.

Viewing Existing Rules and Settings

To start managing your firewall rules, you'll first want to see what's currently in place. Use the following command to list all tables:

nft list tables

This will show you all tables defined in your Nftables configuration. You can further drill down into a specific table to see its chains and rules:

nft list table ip filter

Replace filter with the name of your table to view the relevant chains and rules.

Adding Tables and Chains

Creating a new table is straightforward. Use the following command structure:

nft add table ip filter

Here we are creating a table named filter under the IPv4 protocol family. After creating a table, you can add chains to it:

nft add chain ip filter input { type filter hook input priority 0; }

This command creates a chain named input in the filter table, specifying that it is of type filter, and it will hook into the input processing stage of packets, with a priority of 0.

Adding Rules

With your table and chains in place, you can now start adding rules to filter traffic. Here’s how to add a simple rule that allows incoming SSH traffic (port 22):

nft add rule ip filter input tcp dport 22 accept

This rule matches incoming TCP packets destined for port 22 and accepts them. To confirm that your rule has been added, you can list the rules in the input chain:

nft list chain ip filter input

You can also deny traffic, which is just as simple. For instance, to drop all other incoming traffic:

nft add rule ip filter input drop

Ensure that you have the accept rule above it, or you'll accidentally lock yourself out!

Advanced Rules and Matches

Nftables supports numerous matches and options for creating more complex rules. For example, if you want to limit the rate of incoming SSH connections to 5 per minute per IP address, you can use the following command:

nft add rule ip filter input tcp dport 22 limit rate 5/minute accept

Further, you can also incorporate stateful firewalling by checking the state of a connection:

nft add rule ip filter input ct state established,related accept

This rule will accept packets that are part of an already established connection or related to an established connection. Stateful rules are vital for efficient and secure firewall configurations.

Deleting Rules and Chains

Suppose your requirements change, and you need to delete a specific rule or a whole chain. This can be done easily using the delete command. For instance, to remove the SSH rule we created earlier, you can refer to the exact rule like this:

nft delete rule ip filter input handle <rule_handle>

You must replace <rule_handle> with the handle number of the specific rule you wish to remove, which you can find when listing the chain.

If you want to remove a complete chain, you can do so with:

nft delete chain ip filter input

And, to delete the entire table, run:

nft delete table ip filter

Remember to be cautious when deleting rules or chains to ensure you do not disrupt legitimate traffic.

Saving and Loading Configurations

Once you've set up your firewall rules, it's important to save the configuration to ensure that your settings are preserved across reboots. You can save your current configuration to a file with the following command:

nft list ruleset > /etc/nftables.conf

To load your saved configuration, use:

nft -f /etc/nftables.conf

You can also configure your system to load this ruleset on startup automatically.

Debugging and Monitoring

Sometimes rules might not behave as expected. For debugging, you can enable logging for specific rules. For instance, to log all dropped packets:

nft add rule ip filter input drop log prefix "DROPPED: " group 0

This logs the dropped packets with the specified prefix. Use the dmesg command or check your /var/log/syslog to see these log messages.

Conclusion

Using the nft command-line tool allows you to harness the full power of Nftables to manage your firewall rules and internet traffic. By understanding how to create, modify, and view your rules, you can tailor your network security to meet your specific needs. As you delve deeper into the world of Nftables, exploring advanced features and optimizations will further enhance your network's security posture.

Embrace the versatility of Nftables and the nft tool, and enjoy a robust and secure network infrastructure! Happy configuring!