Firewalls

Packet filtering — stateless, stateful, and Linux iptables/nftables

Stateless Firewalls

A stateless firewall evaluates each packet independently against a static rule set. It has no memory of previous packets — every packet is matched against the ACL from scratch.

Stateful Firewalls

A stateful firewall tracks connection state. When an outbound connection is allowed, return traffic is automatically permitted because the firewall remembers the connection.

Connection tracking states — packets progress through these as the connection evolves

iptables Architecture — In Depth

iptables is the userspace tool that configures the Linux kernel's Netfilter framework. It organizes rules into tables, each containing chains. Understanding the table/chain architecture is essential for debugging packet flow on any Linux host — which includes every container, every Kubernetes node, and most load balancers.

Tables and Their Chains

Packet Flow Through iptables Chains

This is the critical mental model. Every packet entering a Linux box follows this path:

1. PREROUTING

   raw → mangle → nat
   (DNAT happens here)

2. Routing Decision

   Local delivery? Or forward?

3. INPUT

   mangle → filter
   (to local process)

2. Routing Decision

   (packet is for another host)

3. FORWARD

   mangle → filter
   (transit traffic)

4. POSTROUTING

   mangle → nat
   (SNAT/MASQUERADE here)

1. Local Process

   Generates outbound packet

2. OUTPUT

   raw → mangle → nat → filter

3. POSTROUTING

   mangle → nat
   (SNAT/MASQUERADE here)

Rule Matching: Top-to-Bottom, First Match Wins

Targets (Actions)

Example iptables Rules

# Set default policies — DROP everything by default
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback (always needed — many services talk to localhost)
iptables -A INPUT -i lo -j ACCEPT

# Allow established and related connections (stateful rule)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from management subnet only
iptables -A INPUT -p tcp -s 10.0.1.0/24 --dport 22 -j ACCEPT

# Allow HTTP/HTTPS from anywhere
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow ICMP (ping) — rate limited
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Log dropped packets (for debugging — watch with dmesg or journalctl)
iptables -A INPUT -j LOG --log-prefix "IPT-DROP: "

# Everything else hits the default DROP policy

nftables: The iptables Successor

nftables replaces iptables, ip6tables, arptables, and ebtables with a single unified framework. It's the default on modern distros (Debian 10+, RHEL 8+, Ubuntu 20.04+). Under the hood, both iptables and nftables use Netfilter — but nftables has a cleaner kernel interface (nf_tables) vs iptables' per-protocol modules.

Syntax Comparison

# Allow SSH
iptables -A INPUT \
  -p tcp --dport 22 \
  -j ACCEPT

# DNAT port forward
iptables -t nat -A PREROUTING \
  -p tcp --dport 80 \
  -j DNAT \
  --to-destination 10.0.0.5:8080

# Drop a list of IPs (one rule each)
iptables -A INPUT -s 1.2.3.4 -j DROP
iptables -A INPUT -s 5.6.7.8 -j DROP
iptables -A INPUT -s 9.10.11.12 -j DROP

# Allow SSH
nft add rule inet filter input \
  tcp dport 22 accept

# DNAT port forward
nft add rule ip nat prerouting \
  tcp dport 80 \
  dnat to 10.0.0.5:8080

# Drop a list of IPs (single set)
nft add set inet filter blocklist \
  { type ipv4_addr\; }
nft add element inet filter blocklist \
  { 1.2.3.4, 5.6.7.8, 9.10.11.12 }
nft add rule inet filter input \
  ip saddr @blocklist drop

nftables Sets and Maps

Sets are nftables' killer feature for operational use. Instead of O(N) rule-by-rule matching, sets use hash tables or interval trees internally — O(1) or O(log N) lookups regardless of size.

# Define a named set of allowed ports
nft add set inet filter allowed_ports { type inet_service\; }
nft add element inet filter allowed_ports { 22, 80, 443, 8080 }

# Use the set in a rule
nft add rule inet filter input tcp dport @allowed_ports accept

# Maps: verdict maps (key → action)
nft add map inet filter port_policy { type inet_service : verdict\; }
nft add element inet filter port_policy { \
  22 : accept, \
  80 : accept, \
  3306 : drop \
}
nft add rule inet filter input tcp dport vmap @port_policy

Default Policies: DROP vs ACCEPT

iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -P INPUT ACCEPT
# You're trusting that your deny
# rules are exhaustive. They aren't.

Connection Tracking (conntrack)

Conntrack is the kernel subsystem that makes stateful firewalling possible. It tracks every connection (flow) through the host in a hash table, and both iptables and nftables query it to determine whether a packet belongs to a known connection.

Connection States

Inspecting the Conntrack Table

    $ conntrack -L

    tcp   6 431985 ESTABLISHED src=10.0.0.5 dst=93.184.216.34 sport=44820 dport=443 src=93.184.216.34 dst=10.0.0.5 sport=443 dport=44820 [ASSURED] mark=0 use=1

    udp  17 29 src=10.0.0.5 dst=8.8.8.8 sport=53214 dport=53 src=8.8.8.8 dst=10.0.0.5 sport=53 dport=53214 mark=0 use=1


    $ conntrack -C    # Count entries

    2847


    $ sysctl net.netfilter.nf_conntrack_max

    net.netfilter.nf_conntrack_max = 262144
  

Why Conntrack Matters

Conntrack Table Exhaustion

      # Check current usage vs max

      $ conntrack -C

      261890  # Dangerously close to max!


      $ sysctl net.netfilter.nf_conntrack_max

      262144


      # Increase the limit (immediate)

      $ sysctl -w net.netfilter.nf_conntrack_max=524288


      # Persistent: add to /etc/sysctl.d/99-conntrack.conf

      net.netfilter.nf_conntrack_max = 524288

      net.netfilter.nf_conntrack_buckets = 131072


      # Reduce timeouts for faster cleanup

      $ sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600

      $ sysctl -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=30