Configuring firewalls and packet filters

Procedure

1. List the available firewall zones:

   # firewall-cmd --get-zones

   The firewall-cmd --get-zones command displays all zones that are available on the system, but it does not show any details for particular zones. To see more detailed information for all zones, use the firewall-cmd --list-all-zones command.

2. Choose the zone you want to use for this configuration.

3. Modify firewall settings for the chosen zone. For example, to allow the SSH service and remove the ftp service:

   # firewall-cmd --add-service=ssh --zone=<your_chosen_zone>
   # firewall-cmd --remove-service=ftp --zone=<same_chosen_zone>

4. Assign a network interface to the firewall zone:

   1. List the available network interfaces:

      # firewall-cmd --get-active-zones

      Activity of a zone is determined by the presence of network interfaces or source address ranges that match its configuration. The default zone is active for unclassified traffic but is not always active if no traffic matches its rules.

   2. Assign a network interface to the chosen zone:

      # firewall-cmd --zone=<your_chosen_zone> --change-interface=<interface_name> --permanent

      Assigning a network interface to a zone is more suitable for applying consistent firewall settings to all traffic on a particular interface (physical or virtual).

      The firewall-cmd command, when used with the --permanent option, often involves updating NetworkManager connection profiles to make changes to the firewall configuration permanent. This integration between firewalld and NetworkManager ensures consistent network and firewall settings.

Verification

1. Display the updated settings for your chosen zone:

   # firewall-cmd --zone=<your_chosen_zone> --list-all

   The command output displays all zone settings including the assigned services, network interface, and network connections (sources).

1. Display the current default zone:

   # firewall-cmd --get-default-zone

2. Set the new default zone:

   # firewall-cmd --set-default-zone <zone_name>

   Note

   Following this procedure, the setting is a permanent setting, even without the --permanent option.

1. List the active zones and the interfaces assigned to them:

   # firewall-cmd --get-active-zones

2. Assign the interface to a different zone:

   # firewall-cmd --zone=zone_name --change-interface=interface_name --permanent

Procedure

1. Assign the zone to the NetworkManager connection profile:

   # nmcli connection modify profile connection.zone zone_name

2. Activate the connection:

   # nmcli connection up profile

Procedure

1. Determine the path to the connection profile and its format:

   # nmcli -f NAME,FILENAME connection
   NAME    FILENAME
   enp1s0  /etc/NetworkManager/system-connections/enp1s0.nmconnection
   enp7s0  /etc/sysconfig/network-scripts/ifcfg-enp7s0

   NetworkManager uses separate directories and file names for the different connection profile formats:

   • Profiles in /etc/NetworkManager/system-connections/<connection_name>.nmconnection files use the keyfile format.
   • Profiles in /etc/sysconfig/network-scripts/ifcfg-<interface_name> files use the ifcfg format.

2. Depending on the format, update the corresponding file:

   • If the file uses the keyfile format, append zone=<name> to the [connection] section of the /etc/NetworkManager/system-connections/<connection_name>.nmconnection file:

     [connection]
     ...
     zone=internal

   • If the file uses the ifcfg format, append ZONE=<name> to the /etc/sysconfig/network-scripts/ifcfg-<interface_name> file:

     ZONE=internal

3. Reload the connection profiles:

   # nmcli connection reload

4. Reactivate the connection profiles

   # nmcli connection up <profile_name>

Procedure

1. Create a new zone:

   # firewall-cmd --permanent --new-zone=zone-name

2. Make the new zone usable:

   # firewall-cmd --reload

   The command applies recent changes to the firewall configuration without interrupting network services that are already running.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. In the Firewall section, click Add new zone.

5. In the Add zone dialog box, select a zone from the Trust level options.

   The web console displays all zones predefined in the firewalld service.

6. In the Interfaces part, select an interface or interfaces on which the selected zone is applied.

7. In the Allowed Addresses part, you can select whether the zone is applied on:

   • the whole subnet

   • or a range of IP addresses in the following format:

     • 192.168.1.0
     • 192.168.1.0/24
     • 192.168.1.0/24, 192.168.1.0

8. Click on the Add zone button.

   

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. Click on the Options icon at the zone you want to remove.

   

5. Click Delete.

1. List the information for the specific zone to see the default target:

   # firewall-cmd --zone=zone-name --list-all

2. Set a new target in the zone:

   # firewall-cmd --permanent --zone=zone-name --set-target=<default|ACCEPT|REJECT|DROP>

Procedure

1. Check that the service in firewalld is not already allowed:

   # firewall-cmd --list-services
   ssh dhcpv6-client

   The command lists the services that are enabled in the default zone.

2. List all predefined services in firewalld:

   # firewall-cmd --get-services
   RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry ...

   The command displays a list of available services for the default zone.

3. Add the service to the list of services that firewalld allows:

   # firewall-cmd --add-service=<service_name>

   The command adds the specified service to the default zone.

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   The command applies these runtime changes to the permanent configuration of the firewall. By default, it applies these changes to the configuration of the default zone.

Verification

1. List all permanent firewall rules:

   # firewall-cmd --list-all --permanent
   public
     target: default
     icmp-block-inversion: no
     interfaces:
     sources:
     services: cockpit dhcpv6-client ssh
     ports:
     protocols:
     forward: no
     masquerade: no
     forward-ports:
     source-ports:
     icmp-blocks:
     rich rules:

   The command displays complete configuration with the permanent firewall rules of the default firewall zone (public).

2. Check the validity of the permanent configuration of the firewalld service.

   # firewall-cmd --check-config
   success

   If the permanent configuration is invalid, the command returns an error with further details:

   # firewall-cmd --check-config
   Error: INVALID_PROTOCOL: 'public.xml': 'tcpx' not from {'tcp'|'udp'|'sctp'|'dccp'}

   You can also manually inspect the permanent configuration files to verify the settings. The main configuration file is /etc/firewalld/firewalld.conf. The zone-specific configuration files are in the /etc/firewalld/zones/ directory and the policies are in the /etc/firewalld/policies/ directory.

Procedure

1. To enable or disable a predefined or custom service:

   1. Start the firewall-config utility and select the network zone whose services are to be configured.
   2. Select the Zones tab and then the Services tab below.
   3. Select the checkbox for each type of service you want to trust or clear the checkbox to block a service in the selected zone.

2. To edit a service:

   1. Start the firewall-config utility.
   2. Select Permanent from the menu labeled Configuration. Additional icons and menu buttons appear at the bottom of the Services window.
   3. Select the service you want to configure.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrator privileges.

4. In the Firewall section, select a zone for which you want to add the service and click Add Services.

   

5. In the Add Services dialog box, find the service you want to enable on the firewall.

6. Enable services according to your scenario:

   

7. Click Add Services.

Procedure

1. Log in to the RHEL 9 web console.

   For details, see Logging in to the web console.

2. Click Networking.

3. Click on the Edit rules and zones button.

   

   If you do not see the Edit rules and zones button, log in to the web console with the administrative privileges.

4. In the Firewall section, select a zone for which you want to configure a custom port and click Add Services.

   

5. In the Add services dialog box, click on the Custom Ports radio button.

6. In the TCP and UDP fields, add ports according to examples. You can add ports in the following formats:

   • Port numbers such as 22
   • Range of port numbers such as 5900-5910
   • Aliases such as nfs, rsync
   Note

   You can add multiple values into each field. Values must be separated with the comma and without the space, for example: 8080,8081,http

7. After adding the port number in the TCP filed, the UDP filed, or both, verify the service name in the Name field.

   The Name field displays the name of the service for which is this port reserved. You can rewrite the name if you are sure that this port is free to use and no server needs to communicate on this port.

8. In the Name field, add a name for the service including defined ports.

9. Click on the Add Ports button.

   

Procedure

1. Check the currently active firewall zone:

   # firewall-cmd --get-active-zones

2. Add the HTTPS service to the appropriate zone:

   # firewall-cmd --zone=<zone_name> --add-service=https --permanent

3. Reload the firewall configuration:

   # firewall-cmd --reload

Verification

1. Check if the port is open in firewalld:

   • If you opened the port by specifying the port number, enter:

     # firewall-cmd --zone=<zone_name> --list-all

   • If you opened the port by specifying a service definition, enter:

     # firewall-cmd --zone=<zone_name> --list-services

Procedure

1. List all allowed ports:

   # firewall-cmd --list-ports

   By default, this command lists the ports that are enabled in the default zone.

   Note

   This command will only give you a list of ports that are opened as ports. You will not be able to see any open ports that are opened as a service. For that case, consider using the --list-all option instead of --list-ports.

2. Remove the port from the list of allowed ports to close it for the incoming traffic:

   # firewall-cmd --remove-port=port-number/port-type

   This command removes a port from a zone. If you do not specify a zone, it will remove the port from the default zone.

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

   Without specifying a zone, this command applies runtime changes to the permanent configuration of the default zone.

Verification

1. List the active zones and choose the zone you want to inspect:

   # firewall-cmd --get-active-zones

2. List the currently open ports in the selected zone to check if the unused or unnecessary ports are closed:

   # firewall-cmd --zone=<zone_to_inspect> --list-ports

Procedure

1. To immediately disable networking traffic, switch panic mode on:

   # firewall-cmd --panic-on

2. Switching off panic mode reverts the firewall to its permanent settings. To switch panic mode off, enter:

   # firewall-cmd --panic-off

Procedure

1. Start the firewall-config tool and select the network zone whose settings you want to change.
2. Select the Protocols tab and click the Add button on the right-hand side. The Protocol window opens.
3. Either select a protocol from the list or select the Other Protocol check box and enter the protocol in the field.

Procedure

1. List all available zones:

   # firewall-cmd --get-zones

2. Add the source IP to the trusted zone in the permanent mode:

   # firewall-cmd --zone=trusted --add-source=192.168.2.15

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List allowed sources for the required zone:

   # firewall-cmd --zone=zone-name --list-sources

2. Remove the source from the zone permanently:

   # firewall-cmd --zone=zone-name --remove-source=<source>

3. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. List all available zones:

   # firewall-cmd --get-zones
   block dmz drop external home internal public trusted work

2. Add the IP range to the internal zone to route the traffic originating from the source through the zone:

   # firewall-cmd --zone=internal --add-source=192.0.2.0/24

3. Add the http service to the internal zone:

   # firewall-cmd --zone=internal --add-service=http

4. Make the new settings persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. Create a new firewall policy:

   # firewall-cmd --permanent --new-policy podmanToAny

2. Block all traffic from Podman to other zones and allow only necessary services on Podman:

   # firewall-cmd --permanent --policy podmanToAny --set-target REJECT
   # firewall-cmd --permanent --policy podmanToAny --add-service dhcp
   # firewall-cmd --permanent --policy podmanToAny --add-service dns
   # firewall-cmd --permanent --policy podmanToAny --add-service https

3. Create a new Podman zone:

   # firewall-cmd --permanent --new-zone=podman

4. Define the ingress zone for the policy:

   # firewall-cmd --permanent --policy podmanToHost --add-ingress-zone podman

5. Define the egress zone for all other zones:

   # firewall-cmd --permanent --policy podmanToHost --add-egress-zone ANY

   Setting the egress zone to ANY means that you filter from Podman to other zones. If you want to filter to the host, then set the egress zone to HOST.

6. Restart the firewalld service:

   # systemctl restart firewalld

Procedure

1. Create a firewall policy:

   # firewall-cmd --permanent --new-policy <example_policy>

   The policies, as opposed to zones, allow packet filtering for input, output, and forwarded traffic. This is important, because forwarding traffic to endpoints on locally run web servers, containers, or virtual machines requires such capability.

2. Configure symbolic zones for the ingress and egress traffic to also enable the router itself to connect to its local IP address and forward this traffic:

   # firewall-cmd --permanent --policy=<example_policy> --add-ingress-zone=HOST
   # firewall-cmd --permanent --policy=<example_policy> --add-egress-zone=ANY

   The --add-ingress-zone=HOST option refers to packets generated locally and transmitted out of the local host. The --add-egress-zone=ANY option refers to traffic moving to any zone.

3. Add a rich rule that forwards traffic to the web server:

   # firewall-cmd --permanent --policy=<example_policy> --add-rich-rule='rule family="ipv4" destination address="192.0.2.1" forward-port port="443" protocol="tcp" to-port="443" to-addr="192.51.100.20"'

   The rich rule forwards TCP traffic from port 443 on the IP address of the router (192.0.2.1) to port 443 of the IP address of the web server (192.51.100.20).

4. Reload the firewall configuration files:

   # firewall-cmd --reload
   success

5. Activate routing of 127.0.0.0/8 in the kernel:

   • For persistent changes, run:

     # echo "net.ipv4.conf.all.route_localnet=1" > /etc/sysctl.d/90-enable-route-localnet.conf

     The command persistently configures the route_localnet kernel parameter and ensures that the setting is preserved after the system reboots.

   • For applying the settings immediately without a system reboot, run:

     # sysctl -p /etc/sysctl.d/90-enable-route-localnet.conf

     The sysctl command is useful for applying on-the-fly changes, however the configuration will not persist across system reboots.

Verification

1. Connect to the IP address of the router and to the port that you have forwarded to the web server:

   # curl https://192.0.2.1:443

2. Optional: Verify that the net.ipv4.conf.all.route_localnet kernel parameter is active:

   # sysctl net.ipv4.conf.all.route_localnet
   net.ipv4.conf.all.route_localnet = 1

3. Verify that <example_policy> is active and contains the settings you need, especially the source IP address and port, protocol to be used, and the destination IP address and port:

   # firewall-cmd --info-policy=<example_policy>
   example_policy (active)
     priority: -1
     target: CONTINUE
     ingress-zones: HOST
     egress-zones: ANY
     services:
     ports:
     protocols:
     masquerade: no
     forward-ports:
     source-ports:
     icmp-blocks:
     rich rules:
   	rule family="ipv4" destination address="192.0.2.1" forward-port port="443" protocol="tcp" to-port="443" to-addr="192.51.100.20"

Procedure

1. To check if IP masquerading is enabled (for example, for the external zone), enter the following command as root:

   # firewall-cmd --zone=external --query-masquerade

   The command prints yes with exit status 0 if enabled. It prints no with exit status 1 otherwise. If zone is omitted, the default zone will be used.

2. To enable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --add-masquerade

3. To make this setting persistent, pass the --permanent option to the command.

4. To disable IP masquerading, enter the following command as root:

   # firewall-cmd --zone=external --remove-masquerade

   To make this setting permanent, pass the --permanent option to the command.

Procedure

1. Create the /etc/sysctl.d/90-enable-IP-forwarding.conf file with the following content:

   net.ipv4.ip_forward=1

   This setting enables IP forwarding in the kernel. It makes the internal RHEL server act as a router and forward packets from network to network.

2. Load the setting from the /etc/sysctl.d/90-enable-IP-forwarding.conf file:

   # sysctl -p /etc/sysctl.d/90-enable-IP-forwarding.conf

3. Forward incoming HTTP traffic:

   # firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toaddr=198.51.100.10:toport=8080 --permanent

   The previous command defines a DNAT rule with the following settings:

   • --zone=public - The firewall zone for which you configure the DNAT rule. You can adjust this to whatever zone you need.
   • --add-forward-port - The option that indicates you are adding a port-forwarding rule.
   • port=80 - The external destination port.
   • proto=tcp - The protocol indicating that you forward TCP traffic.
   • toaddr=198.51.100.10 - The destination IP address.
   • toport=8080 - The destination port of the internal server.
   • --permanent - The option that makes the DNAT rule persistent across reboots.

4. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

Procedure

1. Create the /etc/sysctl.d/90-enable-IP-forwarding.conf file with the following content:

   net.ipv4.ip_forward=1

   This setting enables IP forwarding in the kernel.

2. Load the setting from the /etc/sysctl.d/90-enable-IP-forwarding.conf file:

   # sysctl -p /etc/sysctl.d/90-enable-IP-forwarding.conf

3. Create the NAT redirect rule:

   # firewall-cmd --zone=public --add-forward-port=port=<standard_port>:proto=tcp:toport=<non_standard_port> --permanent

   The previous command defines the NAT redirect rule with the following settings:

   • --zone=public - The firewall zone, for which you configure the rule. You can adjust this to whatever zone you need.
   • --add-forward-port=port=<non_standard_port> - The option that indicates you are adding a port-forwarding (redirecting) rule with source port on which you initially receive the incoming traffic.
   • proto=tcp - The protocol indicating that you redirect TCP traffic.
   • toport=<standard_port> - The destination port, to which the incoming traffic should be redirected after being received on the source port.
   • --permanent - The option that makes the rule persist across reboots.

4. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

Procedure

1. List available ICMP types and codes:

   # firewall-cmd --get-icmptypes
   address-unreachable bad-header beyond-scope communication-prohibited destination-unreachable echo-reply echo-request failed-policy fragmentation-needed host-precedence-violation host-prohibited host-redirect host-unknown host-unreachable
   ...

   From this predefined list, select which ICMP types and codes to allow or block.

2. Filter specific ICMP types by:

   • Allowing ICMP types:

     # firewall-cmd --zone=<target-zone> --remove-icmp-block=echo-request --permanent

     The command removes any existing blocking rules for the echo requests ICMP type.

   • Blocking ICMP types:

     # firewall-cmd --zone=<target-zone> --add-icmp-block=redirect --permanent

     The command ensures that the redirect messages ICMP type is blocked by the firewall.

3. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

Procedure

1. Create an IP set with a meaningful name:

   # firewall-cmd --permanent --new-ipset=allowlist --type=hash:ip

   The new IP set called allowlist contains IP addresses that you want your firewall to allow.

2. Add a dynamic update to the IP set:

   # firewall-cmd --permanent --ipset=allowlist --add-entry=198.51.100.10

   This configuration updates the allowlist IP set with a newly added IP address that is allowed to pass network traffic by your firewall.

3. Create a firewall rule that references the previously created IP set:

   # firewall-cmd --permanent --zone=public --add-source=ipset:allowlist

   Without this rule, the IP set would not have any impact on network traffic. The default firewall policy would prevail.

4. Reload the firewall configuration to apply the changes:

   # firewall-cmd --reload

Verification

1. List all IP sets:

   # firewall-cmd --get-ipsets
   allowlist

2. List the active rules:

   # firewall-cmd --list-all
   public (active)
     target: default
     icmp-block-inversion: no
     interfaces: enp0s1
     sources: ipset:allowlist
     services: cockpit dhcpv6-client ssh
     ports:
     protocols:
     ...

   The sources section of the command-line output provides insights to what origins of traffic (hostnames, interfaces, IP sets, subnets, and others) are permitted or denied access to a particular firewall zone. In this case, the IP addresses contained in the allowlist IP set are allowed to pass traffic through the firewall for the public zone.

3. Explore the contents of your IP set:

   # cat /etc/firewalld/ipsets/allowlist.xml
   <?xml version="1.0" encoding="utf-8"?>
   <ipset type="hash:ip">
     <entry>198.51.100.10</entry>
   </ipset>

Procedure

1. To query whether lockdown is enabled:

   # firewall-cmd --query-lockdown

2. Manage lockdown configuration by either:

   • Enabling lockdown:

     # firewall-cmd --lockdown-on

   • Disabling lockdown:

     # firewall-cmd --lockdown-off

Procedure

1. Enable packet forwarding in the kernel:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

2. Ensure that interfaces between which you want to enable intra-zone forwarding are assigned only to the internal zone:

   # firewall-cmd --get-active-zones

3. If the interface is currently assigned to a zone other than internal, reassign it:

   # firewall-cmd --zone=internal --change-interface=interface_name --permanent

4. Add the enp1s0 and wlp0s20 interfaces to the internal zone:

   # firewall-cmd --zone=internal --add-interface=enp1s0 --add-interface=wlp0s20

5. Enable intra-zone forwarding:

   # firewall-cmd --zone=internal --add-forward

1. Log in to a host that is on the same network as the enp1s0 interface of the host on which you enabled zone forwarding.

2. Start an echo service with ncat to test connectivity:

   # ncat -e /usr/bin/cat -l 12345

3. Log in to a host that is in the same network as the wlp0s20 interface.

4. Connect to the echo server running on the host that is in the same network as the enp1s0:

   # ncat <other_host> 12345

5. Type something and press Enter. Verify the text is sent back.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Reset firewalld example
     hosts: managed-node-01.example.com
     tasks:
       - name: Reset firewalld
         ansible.builtin.include_role:
           name: rhel-system-roles.firewall
         vars:
           firewall:
             - previous: replaced

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure firewalld
     hosts: managed-node-01.example.com
     tasks:
       - name: Forward incoming traffic on port 8080 to 443
         ansible.builtin.include_role:
           name: rhel-system-roles.firewall
         vars:
           firewall:
             - { forward_port: 8080/tcp;443;, state: enabled, runtime: true, permanent: true }

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure firewalld
     hosts: managed-node-01.example.com
     tasks:
       - name: Allow incoming HTTPS traffic to the local host
         ansible.builtin.include_role:
           name: rhel-system-roles.firewall
         vars:
           firewall:
             - port: 443/tcp
               service: http
               state: enabled
               runtime: true
               permanent: true

   The permanent: true option makes the new settings persistent across reboots.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Configure firewalld
     hosts: managed-node-01.example.com
     tasks:
       - name: Creating a DMZ with access to HTTPS port and masquerading for hosts in DMZ
         ansible.builtin.include_role:
           name: rhel-system-roles.firewall
         vars:
           firewall:
             - zone: dmz
               interface: enp1s0
               service: https
               state: enabled
               runtime: true
               permanent: true

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Write the iptables and ip6tables rules to a file:

   # iptables-save >/root/iptables.dump
   # ip6tables-save >/root/ip6tables.dump

2. Convert the dump files to nftables instructions:

   # iptables-restore-translate -f /root/iptables.dump > /etc/nftables/ruleset-migrated-from-iptables.nft
   # ip6tables-restore-translate -f /root/ip6tables.dump > /etc/nftables/ruleset-migrated-from-ip6tables.nft

3. Review and, if needed, manually update the generated nftables rules.

4. To enable the nftables service to load the generated files, add the following to the /etc/sysconfig/nftables.conf file:

   include "/etc/nftables/ruleset-migrated-from-iptables.nft"
   include "/etc/nftables/ruleset-migrated-from-ip6tables.nft"

5. Stop and disable the iptables service:

   # systemctl disable --now iptables

   If you used a custom script to load the iptables rules, ensure that the script no longer starts automatically and reboot to flush all tables.

6. Enable and start the nftables service:

   # systemctl enable --now nftables

Procedure

1. Edit the /etc/sysconfig/nftables.conf file.

   • If you modified the *.nft scripts that were created in /etc/nftables/ with the installation of the nftables package, uncomment the include statement for these scripts.

   • If you wrote new scripts, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add:

     include "/etc/nftables/_example_.nft"

2. Optional: Start the nftables service to load the firewall rules without rebooting the system:

   # systemctl start nftables

3. Enable the nftables service.

   # systemctl enable nftables

Procedure

1. Create a table named nftables_svc with the inet address family so that the table can process both IPv4 and IPv6 packets:

   # nft add table inet nftables_svc

2. Add a base chain named INPUT, that processes incoming network traffic, to the inet nftables_svc table:

   # nft add chain inet nftables_svc INPUT { type filter hook input priority filter \; policy accept \; }

   To avoid that the shell interprets the semicolons as the end of the command, escape the semicolons using the \ character.

3. Add rules to the INPUT chain. For example, allow incoming TCP traffic on port 22 and 443, and, as the last rule of the INPUT chain, reject other incoming traffic with an Internet Control Message Protocol (ICMP) port unreachable message:

   # nft add rule inet nftables_svc INPUT tcp dport 22 accept
   # nft add rule inet nftables_svc INPUT tcp dport 443 accept
   # nft add rule inet nftables_svc INPUT reject with icmpx type port-unreachable

   If you enter the nft add rule commands as shown, nft adds the rules in the same order to the chain as you run the commands.

4. Display the current rule set including handles:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 443 accept # handle 3
       reject # handle 4
     }
   }

5. Insert a rule before the existing rule with handle 3. For example, to insert a rule that allows TCP traffic on port 636, enter:

   # nft insert rule inet nftables_svc INPUT position 3 tcp dport 636 accept

6. Append a rule after the existing rule with handle 3. For example, to insert a rule that allows TCP traffic on port 80, enter:

   # nft add rule inet nftables_svc INPUT position 3 tcp dport 80 accept

7. Display the rule set again with handles. Verify that the later added rules have been added to the specified positions:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       tcp dport 80 accept # handle 6
       reject # handle 4
     }
   }

8. Remove the rule with handle 6:

   # nft delete rule inet nftables_svc INPUT handle 6

   To remove a rule, you must specify the handle.

9. Display the rule set, and verify that the removed rule is no longer present:

   # nft -a list table inet nftables_svc
   table inet nftables_svc { # handle 13
     chain INPUT { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport 22 accept # handle 2
       tcp dport 636 accept # handle 5
       tcp dport 443 accept # handle 3
       reject # handle 4
     }
   }

10. Remove all remaining rules from the INPUT chain:

    # nft flush chain inet nftables_svc INPUT

11. Display the rule set, and verify that the INPUT chain is empty:

    # nft list table inet nftables_svc
    table inet nftables_svc {
      chain INPUT {
        type filter hook input priority filter; policy accept
      }
    }

12. Delete the INPUT chain:

    # nft delete chain inet nftables_svc INPUT

    You can also use this command to delete chains that still contain rules.

13. Display the rule set, and verify that the INPUT chain has been deleted:

    # nft list table inet nftables_svc
    table inet nftables_svc {
    }

14. Delete the nftables_svc table:

    # nft delete table inet nftables_svc

    You can also use this command to delete tables that still contain chains.

    Note

    To delete the entire rule set, use the nft flush ruleset command instead of manually deleting all rules, chains, and tables in separate commands.

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic to port 80 and 443 on the ens3 interface of the router to the web server with the IP address 192.0.2.1:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

4. Depending on your environment, add either a SNAT or masquerading rule to change the source address for packets returning from the web server to the sender:

   1. If the ens3 interface uses a dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      # nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting chain to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }

   Note that you must pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on port 22 to port 2222:

   # nft add rule nat prerouting tcp dport 22 redirect to 2222

Procedure

1. Add an example-table table of inet family:

   # nft add table inet <example-table>

2. Add an example-flowtable flowtable with ingress hook and filter as a priority type:

   # nft add flowtable inet <example-table> <example-flowtable> { hook ingress priority filter \; devices = { enp1s0, enp7s0 } \; }

3. Add an example-forwardchain flow to the flowtable from a packet processing table:

   # nft add chain inet <example-table> <example-forwardchain> { type filter hook forward priority filter \; }

   This command adds a flowtable of filter type with forward hook and filter priority.

4. Add a rule with established connection tracking state to offload example-flowtable flow:

   # nft add rule inet <example-table> <example-forwardchain> ct state established flow add @<example-flowtable>

Procedure

1. For example, to add a rule to example_chain in example_table that allows incoming traffic to port 22, 80, and 443:

   # nft add rule inet example_table example_chain tcp dport { 22, 80, 443 } accept

2. Optional: Display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport { ssh, http, https } accept
     }
   }

Procedure

1. Create an empty set. The following examples create a set for IPv4 addresses:

   • To create a set that can store multiple individual IPv4 addresses:

     # nft add set inet example_table example_set { type ipv4_addr \; }

   • To create a set that can store IPv4 address ranges:

     # nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }

   Important

   To prevent the shell from interpreting the semicolons as the end of the command, you must escape the semicolons with a backslash.

2. Optional: Create rules that use the set. For example, the following command adds a rule to the example_chain in the example_table that will drop all packets from IPv4 addresses in example_set.

   # nft add rule inet example_table example_chain ip saddr @example_set drop

   Because example_set is still empty, the rule has currently no effect.

3. Add IPv4 addresses to example_set:

   • If you create a set that stores individual IPv4 addresses, enter:

     # nft add element inet example_table example_set { 192.0.2.1, 192.0.2.2 }

   • If you create a set that stores IPv4 ranges, enter:

     # nft add element inet example_table example_set { 192.0.2.0-192.0.2.255 }

     When you specify an IP address range, you can alternatively use the Classless Inter-Domain Routing (CIDR) notation, such as 192.0.2.0/24 in the above example.

Procedure

1. Create a new table:

   # nft add table inet example_table

2. Create the tcp_packets chain in example_table:

   # nft add chain inet example_table tcp_packets

3. Add a rule to tcp_packets that counts the traffic in this chain:

   # nft add rule inet example_table tcp_packets counter

4. Create the udp_packets chain in example_table

   # nft add chain inet example_table udp_packets

5. Add a rule to udp_packets that counts the traffic in this chain:

   # nft add rule inet example_table udp_packets counter

6. Create a chain for incoming traffic. For example, to create a chain named incoming_traffic in example_table that filters incoming traffic:

   # nft add chain inet example_table incoming_traffic { type filter hook input priority 0 \; }

7. Add a rule with an anonymous map to incoming_traffic:

   # nft add rule inet example_table incoming_traffic ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }

   The anonymous map distinguishes the packets and sends them to the different counter chains based on their protocol.

8. To list the traffic counters, display example_table:

   # nft list table inet example_table
   table inet example_table {
     chain tcp_packets {
       counter packets 36379 bytes 2103816
     }
   
     chain udp_packets {
       counter packets 10 bytes 1559
     }
   
     chain incoming_traffic {
       type filter hook input priority filter; policy accept;
       ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }
     }
   }

   The counters in the tcp_packets and udp_packets chain display both the number of received packets and bytes.

Procedure

1. Create a table. For example, to create a table named example_table that processes IPv4 packets:

   # nft add table ip example_table

2. Create a chain. For example, to create a chain named example_chain in example_table:

   # nft add chain ip example_table example_chain { type filter hook input priority 0 \; }

   Important

   To prevent the shell from interpreting the semicolons as the end of the command, you must escape the semicolons with a backslash.

3. Create an empty map. For example, to create a map for IPv4 addresses:

   # nft add map ip example_table example_map { type ipv4_addr : verdict \; }

4. Create rules that use the map. For example, the following command adds a rule to example_chain in example_table that applies actions to IPv4 addresses which are both defined in example_map:

   # nft add rule example_table example_chain ip saddr vmap @example_map

5. Add IPv4 addresses and corresponding actions to example_map:

   # nft add element ip example_table example_map { 192.0.2.1 : accept, 192.0.2.2 : drop }

   This example defines the mappings of IPv4 addresses to actions. In combination with the rule created above, the firewall accepts packet from 192.0.2.1 and drops packets from 192.0.2.2.

6. Optional: Enhance the map by adding another IP address and action statement:

   # nft add element ip example_table example_map { 192.0.2.3 : accept }

7. Optional: Remove an entry from the map:

   # nft delete element ip example_table example_map { 192.0.2.1 }

8. Optional: Display the rule set:

   # nft list ruleset
   table ip example_table {
     map example_map {
       type ipv4_addr : verdict
       elements = { 192.0.2.2 : drop, 192.0.2.3 : accept }
     }
   
     chain example_chain {
       type filter hook input priority filter; policy accept;
       ip saddr vmap @example_map
     }
   }

Procedure

1. Create the /etc/rsyslog.d/nftables.conf file with the following content:

   :msg, startswith, "nft drop" -/var/log/nftables.log
   & stop

   Using this configuration, the rsyslog service logs dropped packets to the /var/log/nftables.log file instead of /var/log/messages.

2. Restart the rsyslog service:

   # systemctl restart rsyslog

3. Create the /etc/logrotate.d/nftables file with the following content to rotate /var/log/nftables.log if the size exceeds 10 MB:

   /var/log/nftables.log {
     size +10M
     maxage 30
     sharedscripts
     postrotate
       /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
     endscript
   }

   The maxage 30 setting defines that logrotate removes rotated logs older than 30 days during the next rotation operation.

Procedure

1. Create the /etc/nftables/firewall.nft script with the following content:

   # Remove all rules
   flush ruleset
   
   
   # Table for both IPv4 and IPv6 rules
   table inet nftables_svc {
   
     # Define variables for the interface name
     define INET_DEV = enp1s0
     define LAN_DEV  = enp7s0
     define DMZ_DEV  = enp8s0
   
   
     # Set with the IPv4 addresses of admin PCs
     set admin_pc_ipv4 {
       type ipv4_addr
       elements = { 10.0.0.100, 10.0.0.200 }
     }
   
   
     # Chain for incoming trafic. Default policy: drop
     chain INPUT {
       type filter hook input priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept incoming traffic on loopback interface
       iifname lo accept
   
       # Allow request from LAN and DMZ to local DNS server
       iifname { $LAN_DEV, $DMZ_DEV } meta l4proto { tcp, udp } th dport 53 accept
   
       # Allow admins PCs to access the router using SSH
       iifname $LAN_DEV ip saddr @admin_pc_ipv4 tcp dport 22 accept
   
       # Last action: Log blocked packets
       # (packets that were not accepted in previous rules in this chain)
       log prefix "nft drop IN : "
     }
   
   
     # Chain for outgoing traffic. Default policy: drop
     chain OUTPUT {
       type filter hook output priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # Accept outgoing traffic on loopback interface
       oifname lo accept
   
       # Allow local DNS server to recursively resolve queries
       oifname $INET_DEV meta l4proto { tcp, udp } th dport 53 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop OUT: "
     }
   
   
     # Chain for forwarding traffic. Default policy: drop
     chain FORWARD {
       type filter hook forward priority filter
       policy drop
   
       # Accept packets in established and related state, drop invalid packets
       ct state vmap { established:accept, related:accept, invalid:drop }
   
       # IPv4 access from LAN and internet to the HTTPS server in the DMZ
       iifname { $LAN_DEV, $INET_DEV } oifname $DMZ_DEV ip daddr 198.51.100.5 tcp dport 443 accept
   
       # IPv6 access from internet to the HTTPS server in the DMZ
       iifname $INET_DEV oifname $DMZ_DEV ip6 daddr 2001:db8:b::5 tcp dport 443 accept
   
       # Access from LAN and DMZ to HTTPS servers on the internet
       iifname { $LAN_DEV, $DMZ_DEV } oifname $INET_DEV tcp dport 443 accept
   
       # Last action: Log blocked packets
       log prefix "nft drop FWD: "
     }
   
   
     # Postrouting chain to handle SNAT
     chain postrouting {
       type nat hook postrouting priority srcnat; policy accept;
   
       # SNAT for IPv4 traffic from LAN to internet
       iifname $LAN_DEV oifname $INET_DEV snat ip to 203.0.113.1
     }
   }

2. Include the /etc/nftables/firewall.nft script in the /etc/sysconfig/nftables.conf file:

   include "/etc/nftables/firewall.nft"

3. Enable IPv4 forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

4. Enable and start the nftables service:

   # systemctl enable --now nftables

Verification

1. Optional: Verify the nftables rule set:

   # nft list ruleset
   ...

2. Try to perform an access that the firewall prevents. For example, try to access the router using SSH from the DMZ:

   # ssh router.example.com
   ssh: connect to host router.example.com port 22: Network is unreachable

3. Depending on your logging settings, search:

   • The systemd journal for the blocked packets:

     # journalctl -k -g "nft drop"
     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

   • The /var/log/nftables.log file for the blocked packets:

     Oct 14 17:27:18 router kernel: nft drop IN : IN=enp8s0 OUT= MAC=... SRC=198.51.100.5 DST=198.51.100.1 ... PROTO=TCP SPT=40464 DPT=22 ... SYN ...

Procedure

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }

   Note

   Pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming packets on port 8022 to the local port 22:

   # nft add rule ip nat prerouting tcp dport 8022 redirect to :22

Procedure

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }

   Note

   Pass the -- option to the nft command to prevent the shell from interpreting the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming packets on port 443 to the same port on 192.0.2.1:

   # nft add rule ip nat prerouting tcp dport 443 dnat to 192.0.2.1

4. Add a rule to the postrouting chain to masquerade outgoing traffic:

   # nft add rule ip nat postrouting daddr 192.0.2.1 masquerade

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Procedure

1. Create the filter table with the inet address family:

   # nft add table inet filter

2. Add the input chain to the inet filter table:

   # nft add chain inet filter input { type filter hook input priority 0 \; }

3. Create a dynamic set for IPv4 addresses:

   # nft add set inet filter limit-ssh { type ipv4_addr\; flags dynamic \;}

4. Add a rule to the input chain that allows only two simultaneous incoming connections to the SSH port (22) from an IPv4 address and rejects all further connections from the same IP:

   # nft add rule inet filter input tcp dport ssh ct state new add @limit-ssh { ip saddr ct count over 2 } counter reject

Verification

1. Establish more than two new simultaneous SSH connections from the same IP address to the host. Nftables refuses connections to the SSH port if two connections are already established.

2. Display the limit-ssh meter:

   # nft list set inet filter limit-ssh
   table inet filter {
     set limit-ssh {
       type ipv4_addr
       size 65535
       flags dynamic
       elements = { 192.0.2.1 ct count over 2 , 192.0.2.2 ct count over 2 }
     }
   }

   The elements entry displays addresses that currently match the rule. In this example, elements lists IP addresses that have active connections to the SSH port. Note that the output does not display the number of active connections or if connections were rejected.

Procedure

1. Create the filter table with the ip address family:

   # nft add table ip filter

2. Add the input chain to the filter table:

   # nft add chain ip filter input { type filter hook input priority 0 \; }

3. Add a set named denylist to the filter table:

   # nft add set ip filter denylist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }

   This command creates a dynamic set for IPv4 addresses. The timeout 5m parameter defines that nftables automatically removes entries after five minutes to prevent that the set fills up with stale entries.

4. Add a rule that automatically adds the source IP address of hosts that attempt to establish more than ten new TCP connections within one minute to the denylist set:

   # nft add rule ip filter input ip protocol tcp ct state new, untracked add @denylist { ip saddr limit rate over 10/minute } drop

Procedure

1. Add a new rule with the counter parameter to the chain. The following example adds a rule with a counter that allows TCP traffic on port 22 and counts the packets and traffic that match this rule:

   # nft add rule inet example_table example_chain tcp dport 22 counter accept

2. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

2. Add the counter by replacing the rule but with the counter parameter. The following example replaces the rule displayed in the previous step and adds a counter:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 counter accept

3. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority filter; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority filter; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

2. Add the tracing feature by replacing the rule but with the meta nftrace set 1 parameters. The following example replaces the rule displayed in the previous step and enables tracing:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 meta nftrace set 1 accept

3. Use the nft monitor command to display the tracing. The following example filters the output of the command to display only entries that contain inet example_table example_chain:

   # nft monitor | grep "inet example_table example_chain"
   trace id 3c5eb15e inet example_table example_chain packet: iif "enp1s0" ether saddr 52:54:00:17:ff:e4 ether daddr 52:54:00:72:2f:6e ip saddr 192.0.2.1 ip daddr 192.0.2.2 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49710 ip protocol tcp ip length 60 tcp sport 56728 tcp dport ssh tcp flags == syn tcp window 64240
   trace id 3c5eb15e inet example_table example_chain rule tcp dport ssh nftrace set 1 accept (verdict accept)
   ...

   Warning

   Depending on the number of rules with tracing enabled and the amount of matching traffic, the nft monitor command can display a lot of output. Use grep or other utilities to filter the output.