nftables

nftables is the new firewall of the linux kernel. It has several advantages over the existing {ip, ip6, arp,eb}tables:

• Only one command
• Rules that target both IPV4 and IPV6
• More concise syntax
• See details on the official wiki

Prerequisite

If you are running Debian Jessie, it is recommended to install the kernel from Jessie Backports.

Install

# apt install nftables

You might also want to remove iptables

# apt purge iptables

Configure

Create main table

Create file /etc/nftables/main.conf

#!/usr/sbin/nft -f

add table inet main

#Ports open for any IP address
add set  inet main  tcp_port_out { type inet_service; }
add set  inet main  tcp_port_in { type inet_service; }
add set  inet main  udp_port_out { type inet_service; }
add set  inet main  udp_port_in { type inet_service; }

# DNS
add element  inet main  udp_port_out { 53 }
add element  inet main  tcp_port_out { 53 }
# Network Time Protocol
add element  inet main  udp_port_out { 123 }
# OpenPGP HTTP Keyserver
add element  inet main  tcp_port_out { 11371 }
# SSH
add element  inet main  tcp_port_in { 2200 }
add element  inet main  tcp_port_out { 2200 }
# Web
add element  inet main  tcp_port_out { 80, 443 }

# Remove spam in logs. Get your top noise whith
# grep Drop_in /var/log/syslog|sed -r 's/.*?PROTO=([A-Z]+).*?DPT=([0-9]+).*/\1 \2/'|sort|uniq -c|sort -rn
add set  inet main  tcp_scan_ports { type inet_service; }
add set  inet main  udp_scan_ports { type inet_service; }
add element  inet main  tcp_scan_ports {
22, # SSH
23 # Telnet
}
add element  inet main  udp_scan_ports {
53, # DNS
5060, # SIP
53413 # http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/
}

chain inet main input {
        type filter  hook input  priority 0;

        # accept any localhost traffic
        iif lo  accept

        # accept traffic originated from us
        ct state established,related  accept
        ct state invalid  log prefix "Invalid_in "  drop

        # accept neighbour discovery otherwise IPv6 connectivity breaks.
        ip6 nexthdr icmpv6  icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert }  accept

        # accept ping
        ip protocol icmp  icmp type { echo-request }  accept

        tcp  dport @tcp_port_in  ct state new  accept
        udp  dport @udp_port_in  ct state new  accept

        tcp dport @tcp_scan_ports drop
        udp dport @udp_scan_ports drop

        # count and drop any other traffic
        counter  log prefix "Drop_in "  drop
}

chain inet main output {
        type filter  hook output  priority 0;

        # accept any localhost traffic
        oif lo  accept

        ct state established,related  accept
        ct state invalid  log prefix "Invalid_out "  drop

        # accept neighbour discovery otherwise IPv6 connectivity breaks.
        ip6 nexthdr icmpv6  icmpv6 type { nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert }  accept

        # accept ping
        ip protocol icmp  icmp type { echo-request }  accept

        tcp  dport @tcp_port_out  ct state new accept
        udp  dport @udp_port_out  ct state new accept

        counter  log prefix "Drop_out "  drop
}

Warning: Double check the port for SSH before activating the script.

Activation Scripts

/etc/nftables.conf

Edit file /etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

include "/etc/nftables/main.conf"

This file is executed when you start nftables. You can also manually execute it without issue.

/etc/nftables/reload_main.conf

This script is used to reload only the main table without the others. The point is to integrate with tools like Fail2Ban which are inserting rules in the firewall. By reloading just the main table, you can activate your new rules without impacting Fail2Ban.

Create file /etc/nftables/reload_main.conf

#!/usr/sbin/nft -f

delete table inet main

include "/etc/nftables/main.conf"

and make it executable

# chmod +x /etc/nftables/reload_main.conf

Test

Test your firewall with the following command

# /etc/nftables.conf; sleep 30; nft flush ruleset

It will activate the firewall and reset it after 30 seconds. It allows you to not lock yourself out of your machine.

Enable

Warning: It is recommended that you test your firewall before enabling it at boot time. An incorrectly configured firewall can lock you out of your machine.

# systemctl enable nftables

It the script output update-rc.d: error: nftables Default-Start contains no runlevels, aborting., don’t worry. The firewall is correctly enabled in systemd. This is bug #804648.