How to Configure nftables Rules from Scratch on GNU/Linux

Intro

In this article, I'll detail a method I use to configure a set of nftables rules on GNU/Linux computers. The aim is to have the most restrictive and precise set of rules possible. This method is suitable for all types of configuration, such as servers, workstations, routers etc. It consists of tracing potentially blocked traffic using a “classic” set of rules, then adding new rules as and when we observe them in the logs.

• This is done in three steps:
  • Add a basic configuration and activate tracing.
  • Analize the logs and add new rules if legitimate traffic is not already explicitly authorized.
  • Once all legitimate traffic has been authorized, activate default blocking.

Let's see how to set this up!

Configure default and known rules

• Here, we're simply configuring a classic set of rules (⚠️remember to replace enp2s0 with the name of your network interface!⚠️) :
  • rules for the local interface
  • to allow ICMP
  • and to accept web traffic

This is a typical profile for most PCs today. Note the presence of lines with “log prefix”. These “accept” rules authorize (for the moment) traffic while collecting all information from every frame passing through them. This will enable us to trace traffic that would have been blocked had the default blocking been enabled.

• Apply the nftables configuration file:

Log analysis

• Here we use the journalctl command to display frames passing through our “log prefix” rules. To do this, we use the “grep” option to filter lines containing the words INPUT, OUTPUT or FORWARD and concerning the kernel (-k option).:

We can see traffic between the addresses 192.168.1.90 (source) and 192.168.1.88 (destination) on the SSH port (22 TCP). In my case, this is perfectly normal, as I'm connected to machine 192.168.1.88 from machine 192.168.1.90 via this protocol. So let's take a look at what needs to be done to authorize this traffic by adding specific rules.

• If we examine the first line in detail, we can see all the information we need to add our nftables rule:
  • Concerns the INPUT chain.
  • Source IP address is 192.168.1.88.
  • Destination IP address 192.168.1.90.
  • Protocol is TCP.
  • Destination port is 22.

• We can do the same with the second line, which concerns the OUTPUT chain:
  • Concern the OUTPUT chain.
  • Source IP address is 192.168.1.90
  • Destination IP address is 192.168.1.88
  • Protocol is TCP.
  • Source port is 22.

Adding the rules

• Once the analysis is complete, we now need to edit our to edit our /etc/nftables.conf configuration file to add our two new rules (one in INPUT and the other in OUTPUT) and place them just before our “log prefix” rules:

• We then apply the new configuration:

• Use the journalctl command again to check that no other legitimate traffic is passing through our “log prefix” rules for INPUT, OUTPUT or FORWARD chains:

If legitimate traffic is detected, simply add new nftables rules, as we did for the SSH service.

Finalizing nftables configuration

At this stage, we should have created all the rules we need to allow legitimate traffic. Now it's time to secure our configuration by modifying the behavior of our “log prefix” rules from accept to drop.

• To do this, edit /etc/nftables.conf once again:

• Then reapply the rules:

We now have a perfectly secure and controlled configuration. And now you know what to do if certain network services don't work or can't be accessed. In this case, all you need to do is reanalyze the logs with the journalctl command and add new rules, as we did earlier for the SSH service.