10 nftables Best Practices

nftables is a new packet filtering framework that is quickly gaining popularity. It is replacing the iptables framework, which has been the go-to for Linux firewalls for many years. nftables offers a more efficient and flexible way of managing network traffic.

In this article, we will discuss 10 best practices for using nftables to secure your network. We will cover topics such as setting up rules, logging, and performance optimization. By following these best practices, you can ensure that your network is secure and running at peak performance.

1. Utilize nftables for packet filtering and connection tracking

Nftables is a powerful packet filtering and connection tracking tool that can be used to protect networks from malicious traffic. It provides an efficient way of managing network traffic, allowing administrators to quickly identify and block suspicious activity.

The nftables framework allows for the creation of rulesets which define how packets are filtered and tracked. These rulesets can be configured to allow or deny certain types of traffic based on source and destination IP addresses, port numbers, protocols, and other criteria. This makes it easy to create custom rulesets tailored to specific needs.

Connection tracking is also possible with nftables. This feature allows administrators to monitor active connections and detect any suspicious behavior. By keeping track of established connections, nftables can help prevent malicious actors from gaining access to sensitive information.

2. Create separate chains for each type of traffic

Creating separate chains for each type of traffic allows you to easily manage and organize your rules. This makes it easier to troubleshoot any issues that may arise, as well as quickly identify which rule is causing a problem. Additionally, this helps keep the nftables configuration more organized and readable.

To create separate chains for each type of traffic, you can use the “chain” command in nftables. This command creates a new chain with a specified name and policy (accept or drop). You can then add rules to the chain using the “add rule” command. For example, if you wanted to create a chain for incoming SSH traffic, you could use the following commands:

nft add chain input ssh-traffic { type filter hook input priority 0 \; }

nft add rule input ssh-traffic tcp dport 22 accept

The first command creates a new chain called “ssh-traffic” and sets its type to “filter” and hook to “input”. The second command adds a rule to the chain that accepts all incoming TCP traffic on port 22 (the default port for SSH).

3. Establish a default policy to drop all incoming packets

The primary purpose of a firewall is to protect the system from malicious traffic. By default, nftables allows all incoming packets unless explicitly blocked by rules. This means that any new services or ports opened on the system are automatically exposed to the public internet without any protection.

Establishing a default policy to drop all incoming packets helps prevent this type of exposure. It ensures that only those connections and services specifically allowed by the administrator will be accepted. All other incoming traffic is dropped before it can reach the system.

To implement this policy in nftables, you need to create an input chain with two rules. The first rule should accept established and related connections, while the second rule should drop all other incoming packets. This way, existing connections are not disrupted, but all other incoming traffic is blocked.

4. Prioritize rules from most specific to least specific

When using nftables, the order of rules matters. Rules are evaluated in sequence from top to bottom, and if a packet matches multiple rules, the first matching rule is applied. This means that more specific rules should be placed before less specific ones.

For example, if you have two rules – one allowing all traffic from 192.168.0.0/24 and another denying all traffic from 192.168.0.10 – then the most specific rule (denying traffic from 192.168.0.10) should come first. Otherwise, the less specific rule will take precedence and the deny rule won’t work as expected.

Prioritizing rules from most specific to least specific also helps with performance. Since nftables evaluates rules sequentially, it’s important to make sure that the most common packets match the most specific rules so they don’t need to traverse through the entire list of rules. This way, nftables can quickly identify which action needs to be taken for each packet.

5. Log dropped or rejected packets using the log action

Logging dropped or rejected packets is a great way to monitor the security of your system. It allows you to detect malicious activity, such as port scans and other suspicious traffic. This can help you identify potential threats before they become an issue.

The log action in nftables also provides detailed information about the packet that was dropped or rejected. This includes the source IP address, destination IP address, protocol, and port number. This information can be used to investigate further and determine if any additional steps need to be taken.

Using the log action is relatively simple. All you have to do is add it to the end of your rule set. For example, if you want to log all incoming ICMP requests, you would use the following command:

nft add rule filter input icmp type echo-request log prefix “ICMP request received”

This will log all incoming ICMP requests with the message “ICMP request received”. You can then review these logs for any suspicious activity.

6. Leverage stateful tracking to reduce rule complexity

Stateful tracking is a feature of nftables that allows the firewall to keep track of connections and their states. This means that instead of having to create rules for each connection, you can simply specify one rule that applies to all connections in a certain state. For example, if you want to allow incoming SSH traffic, you don’t need to create separate rules for each new connection; you just need to set up one rule that applies to all established connections.

This reduces complexity by eliminating the need to create multiple rules for every single connection. Instead, you only have to create one rule that applies to all connections in a certain state. This makes it much easier to manage your firewall rules, as you don’t have to worry about creating individual rules for each connection.

Additionally, leveraging stateful tracking also helps improve performance. Since there are fewer rules to process, the firewall can process packets more quickly, resulting in better overall performance.

7. Avoid using the same chain for both input and output

When using nftables, it is important to remember that the order of rules matters. If a packet matches multiple rules, the first rule will be applied and no other rules will be evaluated. This means that if you use the same chain for both input and output, the rules in the chain will be evaluated twice – once for incoming packets and again for outgoing packets.

Using separate chains for input and output allows you to apply different sets of rules depending on whether the packet is incoming or outgoing. For example, you can allow all incoming traffic but only allow certain types of outgoing traffic. This helps ensure that your system is secure by preventing malicious actors from sending outbound traffic that could compromise your system.

Additionally, separating input and output into two distinct chains makes it easier to troubleshoot any issues with your firewall configuration. By having two separate chains, you can quickly identify which set of rules is causing an issue without having to search through a single long chain.

8. Make use of sets to simplify complex rules

Sets are collections of objects, such as IP addresses or ports. They allow you to group multiple elements together and apply a single rule to the entire set instead of having to write out individual rules for each element. This makes it much easier to manage large numbers of rules, since you can add or remove elements from the set without having to rewrite all the associated rules.

Using sets also helps improve performance by reducing the number of rules that need to be evaluated. When nftables processes a packet, it has to check every rule in the table until it finds one that matches. If you have a lot of rules with similar conditions, using sets allows you to combine them into a single rule which reduces the amount of work nftables needs to do.

9. Keep an audit trail of changes made to your firewall configuration

An audit trail is a record of changes made to the firewall configuration, which can be used for troubleshooting and security purposes. It allows you to track who made what changes, when they were made, and why they were made. This helps ensure that any changes are intentional and authorized, as well as providing an easy way to roll back any unwanted or unauthorized changes.

The best way to keep an audit trail is to use version control software such as Git. This will allow you to store your nftables configuration in a repository, where it can be tracked and managed over time. You can also set up automated backups so that if something goes wrong, you can quickly restore your configuration from a previous version. Additionally, using version control makes it easier to collaborate with other administrators on managing your firewall configuration.

10. Test any new rules before deploying them in production

Testing new rules before deploying them in production is important because it allows you to identify any potential issues with the rule set. This can help prevent unexpected behavior or errors that could cause downtime or other problems. Additionally, testing helps ensure that the rules are working as expected and will not interfere with existing services or applications.

The best way to test nftables rules is to use a virtual machine (VM) environment. This allows you to create an isolated environment where you can safely test your rules without affecting the production system. You can also use this VM environment to simulate different scenarios and traffic patterns to make sure your rules are functioning correctly.

Once you have tested your rules in the VM environment, you should then deploy them on a staging server. This allows you to further test the rules in a more realistic environment and verify that they work as expected. Once you are satisfied with the results, you can then deploy the rules to the production system.