Homework — Lesson 01
~15 min · Two tasks · Bash only
Task 1 — Allow only SSH and HTTP, drop everything else
Using iptables, write rules that:
- Allow inbound SSH (TCP/22) from anywhere.
- Allow inbound HTTP (TCP/80) from anywhere.
- Allow established/related return traffic.
- Drop everything else inbound.
- Allow all loopback traffic.
Self-check:
sudo iptables -L -v -nshows your rules.- From another host,
nmap -p 22,80,443 <your-ip>shows 22 and 80 open, 443 filtered. - Ping (ICMP) is blocked from outside.
Task 2 — Translate to nftables and persist
Recreate the same firewall using nftables:
- Create a table and an input chain hooked at filter priority 0.
- Add the four rules from Task 1.
- Save the ruleset:
sudo nft list ruleset > rules.nft. - Flush, then reload from file:
sudo nft flush ruleset && sudo nft -f rules.nft.
Self-check:
sudo nft list rulesetshows the same effective rules as Task 1.- The
rules.nftfile is human-readable and can be edited.