Lesson 01 — Packet Filtering

From iptables to nftables, beginner edition.

Linux Networking

In this lesson you will learn how the Linux kernel inspects and filters network packets using the netfilter framework, how to write and read iptables rules, what conntrack is and why it matters, and how the newer nftables tool improves on the classic toolchain.

What is a firewall on Linux?

The 5 netfilter hooks

• PREROUTING — first hook, before routing decision; used for DNAT
• INPUT — packets destined for the local machine
• FORWARD — packets routed through this machine (router/gateway)
• OUTPUT — packets generated by the local machine
• POSTROUTING — last hook, after routing decision; used for SNAT/MASQUERADE

Tables vs chains

iptables organises rules into tables (purpose) and chains (hook attachment points).

Stateful inspection (conntrack)

• NEW — first packet of a connection (e.g. SYN); conntrack creates a tracking entry
• ESTABLISHED — packets belonging to an already-opened connection; allowed through without re-inspection
• RELATED — packets related to an existing connection (e.g. ICMP errors, FTP data channel)
• INVALID — packet doesn't match any known connection and looks malformed; should be dropped

iptables crash course

Three commands every sysadmin needs to know:

List all rules with packet/byte counters:

iptables -L -v -n

The -v flag shows interface and packet/byte counters. -n prevents slow DNS lookups — always use it.

Allow inbound SSH:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Appends (-A) a rule to the INPUT chain: TCP on port 22 → ACCEPT. The -A adds to the end; use -I to insert at a specific position.

Set default policy to drop all inbound:

iptables -P INPUT DROP

The policy is the fallback when no rule matches. Set this after adding ACCEPT rules for needed services, or you will lock yourself out.

Reading a rule like a sentence

iptables  -A INPUT  -p tcp  --dport 22  -m conntrack --ctstate NEW,ESTABLISHED  -j ACCEPT

Read it aloud: "For all TCP packets arriving at port 22 that are new or part of an established connection, accept them."

NAT in action

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

MASQUERADE is dynamic SNAT — it automatically uses the current IP of the outgoing interface. Ideal for dynamic IP addresses (home routers, VMs sharing a host NIC).

DROP vs REJECT

iptables -A INPUT -p tcp --dport 23 -j DROP

iptables -A INPUT -p tcp --dport 23 -j REJECT \
  --reject-with tcp-reset

nftables — what changed and why

nftables replaced iptables as the recommended Linux firewall tool starting with kernel 3.13 (2014), and became the default in Debian 10 / RHEL 8.

• Single binary — nft replaces four tools: iptables, ip6tables, arptables, ebtables. One syntax for IPv4, IPv6, ARP, and bridge filtering.
• Native sets — you can match against a set of IPs, ports, or prefixes with a single rule instead of a loop of rules: ip saddr @blocked_ips drop. Performance scales sub-linearly.
• Atomic reloads — the entire ruleset is loaded as one transaction: nft -f rules.nft. No window where partial rules leave the machine exposed.
• Cleaner syntax — rules read more like prose; the table/chain/rule hierarchy is explicit and user-defined rather than baked into the tool.

# List all tables and rules
nft list ruleset

# Load a complete ruleset from a file (atomic)
nft -f /etc/nftables.conf

iptables vs nftables — side by side

Both tools write rules into the same kernel netfilter subsystem — they can coexist but may conflict; pick one per production system.

Migration & gotchas

• iptables-translate — converts individual iptables rules to nftables syntax. Run iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT to get the equivalent nft line. Not 100% coverage, but a great starting point.
• Rule order matters — iptables uses first-match; nftables uses first-match by default but supports policy accept/drop per chain. Moving from one to the other can silently change behaviour if chain policies differ.
• Default-allow vs default-deny — fresh installations often have an ACCEPT policy on all chains. Always audit with iptables -L -v -n or nft list ruleset before assuming a host is hardened.
• conntrack on UDP — UDP is stateless at the protocol level, but conntrack still tracks UDP "connections" (source/dest 4-tuple). Rules like -m conntrack --ctstate ESTABLISHED work for DNS, QUIC, and other UDP protocols.
• Persistence — iptables rules are lost on reboot unless saved with iptables-save / iptables-restore or via netfilter-persistent. nftables rules are loaded from /etc/nftables.conf by systemd on boot if the service is enabled.

Recap

• Netfilter is the kernel engine — iptables and nftables are just front-end tools that write rules into it. Five hooks (PREROUTING → INPUT / FORWARD → OUTPUT → POSTROUTING) define where rules can intercept packets.
• Conntrack makes rules smarter — stateful matching (-m conntrack --ctstate ESTABLISHED,RELATED) lets you write a single inbound ACCEPT rule instead of one per response port, and is the foundation of NAT.
• nftables is the future, but iptables is still everywhere — understand both. Use iptables-translate to convert existing rules and nft list ruleset to audit nftables configuration.