nftables Configuration Templates

The following templates can be used to secure servers with nftables.

Basic Usage

To load the firewall rules:

# Check the syntax of /etc/nftables.conf
nftables -f /etc/nftables.conf -c

# Apply the firewall rules if no errors
nftables -f /etc/nftables.conf

Counters are used for traffic that is dropped; to get the counter statistics:

# Get all counters
nft list counters

# Show specific counter
nft list counter inet filter input_icmpv4_ping

To list all rules:

# List all rules for all tables
# This will also list any counters and IP's in sets
nft list ruleset

Sets

These firewalls make use of sets to restrict groups of IP’s from services/all traffic.

The input_timeout_ipv4 and input_timeout_ipv6 sets are used to restrict all inbound IPv4 or IPv6 traffic from IP’s or networks. IP’s/networks added to these sets will timeout after 24 hours (by default). To add entries the add element command can be used:

# Block all inbound IPv4 traffic from these IP's/networks:
# 192.0.2.1, 192.0.2.250 and 192.0.2.240/29
nft add element inet filter input_timeout_ipv4 '{ 192.0.2.1, 192.0.2.250 }'

# Block all inbound IPv6 traffic from these IP's networks:
# 2001:0db8::4, 2001:0db8:ffff::/48
nft add element inet filter input_timeout_ipv6 '{ 2001:0db8::4, 2001:0db8:ffff::/48 }'

Templates

Multiple templates are available below for different restrictions.

Relaxed Template

This template will permit HTTP, HTTPS and SSH traffic inbound (for both IPv4 and IPv6) from anywhere. Unmatched inbound traffic will be dropped. There are no outbound rules configured; all outbound traffic is permitted.

#!/usr/sbin/nft -f

flush ruleset

table inet filter {

    # IPv4 IP's listed in this set will have all inbound IPv4 traffic dropped for 24 hours
    # To add IP's to the set:
    #   nft add element inet filter input_timeout_ipv4 '{ 192.0.2.1, 192.0.2.250 }'
    set input_timeout_ipv4 {
        type ipv4_addr
        flags timeout, interval
        timeout 1d
    }

    # IPv6 IP's listed in this set will have all inbound IPv6 traffic dropped for 24 hours
    # To add IP's to the set:
    #   nft add element inet filter input_timeout_ipv6 '{ 2001:0db8::4 }'
    set input_timeout_ipv6 {
        type ipv6_addr
        flags timeout, interval
        timeout 1d
    }

    # Create the counters for below rules
    counter input_timeout_ipv4 {}
    counter input_timeout_ipv6 {}
    counter input_tcp_no_syn {}
    counter input_tcp_scan_1 {}
    counter input_tcp_scan_2 {}
    counter input_tcp_scan_3 {}
    counter input_tcp_scan_4 {}
    counter input_invalid_state {}
    counter input_icmpv6_required {}
    counter input_icmpv6_ping {}
    counter input_icmpv6_dropped {}
    counter input_icmpv4_required {}
    counter input_icmpv4_ping {}
    counter input_icmpv4_dropped {}
    counter input_traceroute {}
    counter input_policy {}

    chain forward {
        type filter hook forward priority 0; policy drop
    }

    chain input {
        type filter hook input priority 0; policy drop

        # Drop traffic early
        ip saddr @input_timeout_ipv4 counter name input_timeout_ipv4 drop comment "Early drop IPv4 traffic from the prefixes listed in input_timeout_ipv4"
        ip6 saddr @input_timeout_ipv6 counter name input_timeout_ipv6 drop comment "Early drop IPv6 traffic from the prefixes listed in input_timeout_ipv6"

        # Permit all established connections
        ct state established,related accept comment "Permit established/related connections"

        # Permit all loopback
        iif lo accept comment "Permit all traffic via loopback interface"

        # Drop TCP traffic with invalid flags
        tcp flags != syn ct state new log prefix "New TCP without SYN: " counter name input_tcp_no_syn drop comment "Drop new connections that do not have the SYN TCP flag set"
        tcp flags & (fin|syn) == (fin|syn) log prefix "Port scan 1: " counter name input_tcp_scan_1 drop comment "Drop common port scan traffic"
        tcp flags & (syn|rst) == (syn|rst) log prefix "Port scan 2: " counter name input_tcp_scan_2 drop comment "Drop common port scan traffic"
        tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) log prefix "Port scan 3:" counter name input_tcp_scan_3 drop comment "Drop common port scan traffic"
        tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) log prefix "Port scan 4:" name input_tcp_scan_4 counter drop comment "Drop common port scan traffic"

        # Drop invalid connection state traffic
        ct state invalid log flags all prefix "Invalid conntrack state: " counter name input_invalid_state drop comment "Drop traffic with invalid connection state"

        # Allow SSH, HTTP, HTTPS
        tcp dport { ssh, http, https } ct state new accept comment "Permit inbound TCP traffic to services hosted on this server"

        # Permit and rate limit required ICMPv6 types
        ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, destination-unreachable, packet-too-big,
            time-exceeded, nd-router-advert, mld-listener-query, parameter-problem } counter name input_icmpv6_required accept comment "Permit required ICMPv6 types without rate limit"
        ip6 nexthdr icmpv6 icmpv6 type { echo-reply, echo-request } limit rate 250/second counter name input_icmpv6_ping accept comment "Rate limit IPv4 echo (ping)"
        ip6 nexthdr icmpv6 log flags all prefix "Prohibited ICMPv6: " counter name input_icmpv6_dropped drop comment "Log and drop all other ICMPv6 types"

        # Permit and rate limit required ICMPv4 types
        ip protocol icmp icmp type { destination-unreachable, source-quench, time-exceeded, parameter-problem } counter name input_icmpv6_required accept comment "Permit required ICMPv4 types without rate limit"
        ip protocol icmp icmp type { echo-reply, echo-request } limit rate 250/second counter  name input_icmpv4_ping accept comment "Rate limit IPv4 echo (ping)"
        ip protocol icmp log flags all prefix "Prohibited ICMPv4: " counter name input_icmpv4_dropped drop comment "Log and drop all other ICMPv4 types"

        # Permit and rate limit traceroute
        udp dport 33434-33524 limit rate 50/second counter name input_traceroute accept comment "Rate limit traceroute"

        # Drop unmatched traffic
        counter name input_policy log prefix "Default policy: "
    }

    chain output {
        type filter hook output priority 0; policy accept
    }

}

Strict Template

This template will allow inbound HTTP, HTTPS and SSH – similar to the above relaxed template. How ever, this template will also restrict outbound traffic.

Outbound traffic will be limited to any HTTP/HTTPS destinations, any NTP destinations and DNS traffic to the Cloudflare and Google public resolvers.

#!/usr/sbin/nft -f

flush ruleset

table inet filter {

    # Set default policy for forward traffic to drop
    chain forward {
        type filter hook forward priority 0; policy drop
    }

    # Create the counters for input rules
    counter input_timeout_ipv4 {}
    counter input_timeout_ipv6 {}
    counter input_tcp_no_syn {}
    counter input_tcp_scan_1 {}
    counter input_tcp_scan_2 {}
    counter input_tcp_scan_3 {}
    counter input_tcp_scan_4 {}
    counter input_invalid_state {}
    counter input_icmpv6_required {}
    counter input_icmpv6_ping {}
    counter input_icmpv6_dropped {}
    counter input_icmpv4_required {}
    counter input_icmpv4_ping {}
    counter input_icmpv4_dropped {}
    counter input_traceroute {}
    counter input_policy_default {}

    # IPv4 IP's listed in this set will have all inbound IPv4 traffic dropped for 24 hours
    # To add IP's to the set:
    #   nft add element inet filter input_timeout_ipv4 '{ 192.0.2.1, 192.0.2.250 }'
    set input_timeout_ipv4 {
        type ipv4_addr
        flags timeout, interval
        timeout 1d
    }

    # IPv6 IP's listed in this set will have all inbound IPv6 traffic dropped for 24 hours
    # To add IP's to the set:
    #   nft add element inet filter input_timeout_ipv6 '{ 2001:0DB8::4 }'
    set input_timeout_ipv6 {
        type ipv6_addr
        flags timeout, interval
        timeout 1d
    }

    # Add input (inbound) rules
    chain input {
        type filter hook input priority 0; policy drop

        # Drop traffic early
        ip saddr @input_timeout_ipv4 counter name input_timeout_ipv4 drop comment "Early drop IPv4 traffic from the prefixes listed in input_timeout_ipv4"
        ip6 saddr @input_timeout_ipv6 counter name input_timeout_ipv6 drop comment "Early drop IPv6 traffic from the prefixes listed in input_timeout_ipv6"

        # Permit all established connections
        ct state established,related accept comment "Permit established/related connections"

        # Permit all loopback
        iif lo accept comment "Permit all traffic via loopback interface"

        # Drop TCP traffic with invalid flags
        tcp flags != syn ct state new log prefix "IN - New !SYN: " counter name input_tcp_no_syn drop comment "Drop new connections that do not have the SYN TCP flag set"
        tcp flags & (fin|syn) == (fin|syn) log prefix "IN - Scan 1: " counter name input_tcp_scan_1 drop comment "Drop common port scan traffic"
        tcp flags & (syn|rst) == (syn|rst) log prefix "IN - Scan 2: " counter name input_tcp_scan_2 drop comment "Drop common port scan traffic"
        tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) log prefix "IN - Scan 3:" counter name input_tcp_scan_3 drop comment "Drop common port scan traffic"
        tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) log prefix "IN - Scan 4:" counter name input_tcp_scan_4 drop comment "Drop common port scan traffic"

        # Drop invalid connection state traffic
        ct state invalid log flags all prefix "IN - Invalid: " counter name input_invalid_state drop comment "Drop traffic with invalid connection state"

        # Allow HTTP and HTTPS
        tcp dport { http, https } ct state new accept comment "Permit inbound HTTP and HTTPS"

        # Allow SSH
        tcp dport ssh ct state new accept comment "Permit inbound SSH"

        # Permit and rate limit required ICMPv6 types
        ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, destination-unreachable, packet-too-big,
            time-exceeded, nd-router-advert, mld-listener-query, parameter-problem } counter name input_icmpv6_required accept comment "Permit required ICMPv6 types without rate limit"
        ip6 nexthdr icmpv6 icmpv6 type { echo-reply, echo-request } limit rate 250/second counter name input_icmpv6_ping accept comment "Rate limit IPv4 echo (ping)"
        ip6 nexthdr icmpv6 log flags all prefix "IN - Prohibited ICMPv6: " counter name input_icmpv6_dropped drop comment "Log and drop all other ICMPv6 types"

        # Permit and rate limit required ICMPv4 types
        ip protocol icmp icmp type { destination-unreachable, source-quench, time-exceeded, parameter-problem } counter name input_icmpv6_required accept comment "Permit required ICMPv4 types without rate limit"
        ip protocol icmp icmp type { echo-reply, echo-request } limit rate 250/second counter name input_icmpv4_ping accept comment "Rate limit IPv4 echo (ping)"
        ip protocol icmp log flags all prefix "IN - Prohibited ICMPv4: " counter name input_icmpv4_dropped drop comment "Log and drop all other ICMPv4 types"

        # Permit and rate limit traceroute
        udp dport 33434-33524 limit rate 50/second counter name input_traceroute accept comment "Rate limit traceroute"

        # Log and count any unmatched traffic
        counter name input_policy_default log prefix "IN - Default: "
    }

    # Create the counters for output rules
    counter output_timeout_ipv4 {}
    counter output_timeout_ipv6 {}
    counter output_invalid_state {}
    counter output_icmpv6_required {}
    counter output_icmpv6_ping {}
    counter output_icmpv6_dropped {}
    counter output_icmpv4_required {}
    counter output_icmpv4_ping {}
    counter output_icmpv4_dropped {}
    counter output_traceroute {}
    counter output_policy_default {}

    # IPv4 IP's listed in this set will have all outbound IPv4 traffic dropped for 24 hours
    # To add IP's to the set:
    #   nft add element inet filter output_timeout_ipv4 '{ 192.0.2.1, 192.0.2.250 }'
    set output_timeout_ipv4 {
        type ipv4_addr
        flags timeout, interval
        timeout 1d
    }

    # IPv6 IP's listed in this set will have all outbound IPv6 traffic dropped for 24 hours
    # To add IP's to the set:
    #   nft add element inet filter output_timeout_ipv6 '{ 2001:0DB8::4 }'
    set output_timeout_ipv6 {
        type ipv6_addr
        flags timeout, interval
        timeout 1d
    }

    # List of IPv4 DNS servers that outbound queries are sent to
    set output_dns_ipv4 {
        type ipv4_addr
        elements = {
            1.1.1.1,
            1.0.0.1,
            8.8.8.8,
            8.8.4.4
        }
    }

    # List of IPv4 DNS servers that outbound queries are sent to
    set output_dns_ipv6 {
        type ipv6_addr
        elements = {
            2606:4700:4700::1111,
            2606:4700:4700::1001,
            2001:4860:4860::8888,
            2001:4860:4860::8844
        }
    }

    # Add output (outbound) rules
    chain output {
        type filter hook output priority 0; policy drop

        # Drop traffic early
        ip saddr @output_timeout_ipv4 counter name output_timeout_ipv4 drop comment "Early drop IPv4 traffic to the prefixes listed in output_timeout_ipv4"
        ip6 saddr @output_timeout_ipv6 counter name output_timeout_ipv6 drop comment "Early drop IPv6 traffic to the prefixes listed in output_timeout_ipv6"

        # Permit all established connections
        ct state established,related accept comment "Permit established/related connections"

        # Permit all loopback
        oif lo accept comment "Permit all traffic via loopback interface"

        # Drop invalid connection state traffic
        ct state invalid log flags all prefix "OUT - Invalid: " counter name output_invalid_state drop comment "Drop traffic with invalid connection state"

        # Allow HTTP and HTTPS
        tcp dport { http, https } ct state new accept comment "Permit outbound HTTP and HTTPS"

        # Allow IPv4 DNS queries to DNS servers
        ip daddr @output_dns_ipv4 udp dport domain accept comment "Permit outbound IPv4 UDP DNS"
        ip daddr @output_dns_ipv4 tcp dport domain accept comment "Permit outbound IPv4 TCP DNS"
        ip6 daddr @output_dns_ipv6 udp dport domain accept comment "Permit outbound IPv6 UDP DNS"
        ip6 daddr @output_dns_ipv6 tcp dport domain accept comment "Permit outbound IPv6 TCP DNS"

        # Allow outbound SMTP submission
        tcp dport 587 ct state new accept comment "Permit outbound SMTP submission traffic"

        # Allow outbound NTP
        udp dport ntp accept comment "Permit outbound NTP"

        # Permit and rate limit required ICMPv6 types
        ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, destination-unreachable, packet-too-big,
            time-exceeded, nd-router-advert, mld-listener-query, parameter-problem } counter name output_icmpv6_required accept comment "Permit required ICMPv6 types without rate limit"
        ip6 nexthdr icmpv6 icmpv6 type { echo-reply, echo-request } limit rate 250/second counter name output_icmpv6_ping accept comment "Rate limit IPv4 echo (ping)"
        ip6 nexthdr icmpv6 log flags all prefix "OUT - Prohibited ICMPv6: " counter name output_icmpv6_dropped drop comment "Log and drop all other ICMPv6 types"

        # Permit and rate limit required ICMPv4 types
        ip protocol icmp icmp type { destination-unreachable, source-quench, time-exceeded, parameter-problem } counter name output_icmpv6_required accept comment "Permit required ICMPv4 types without rate limit"
        ip protocol icmp icmp type { echo-reply, echo-request } limit rate 250/second counter  name output_icmpv4_ping accept comment "Rate limit IPv4 echo (ping)"
        ip protocol icmp log flags all prefix "OUT - Prohibited ICMPv4: " counter name output_icmpv4_dropped drop comment "Log and drop all other ICMPv4 types"

        # Permit and rate limit traceroute
        udp dport 33434-33524 limit rate 50/second counter name output_traceroute accept comment "Rate limit traceroute"

        # Log and count any unmatched traffic
        counter name output_policy_default log prefix "OUT - Default: "
    }

}

Leave a Reply

Your email address will not be published.