firewalld, nftables and iptables

firewall-cmd --state                                # running
firewall-cmd --get-default-zone                     # public on a fresh install
firewall-cmd --get-active-zones                     # zones with interfaces or sources bound
firewall-cmd --get-zones                            # block dmz drop external home internal nm-shared public trusted work
firewall-cmd --list-all                             # default zone in full
firewall-cmd --list-all --zone=internal
firewall-cmd --list-all-zones                       # every zone; long
firewall-cmd --get-zone-of-interface=eth0
firewall-cmd --get-services                         # ~200 predefined services: http https ssh dns nfs samba ...
firewall-cmd --info-service=https                   # ports the service maps to
firewall-cmd --permanent --list-all                 # what is on disk, versus runtime

firewall-cmd --set-default-zone=drop                                    # new interfaces land here
firewall-cmd --zone=internal --change-interface=eth1 --permanent         # NetworkManager-managed interfaces: also nmcli con mod eth1 connection.zone internal
firewall-cmd --zone=trusted --add-source=192.0.2.0/24 --permanent        # source-based zone: this range is trusted on any interface
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --zone=public --add-service={http,https} --permanent
firewall-cmd --zone=public --add-port=8443/tcp --permanent
firewall-cmd --zone=public --add-port=60000-61000/udp --permanent        # port range
firewall-cmd --zone=public --remove-service=cockpit --permanent
firewall-cmd --zone=public --remove-service=ssh --permanent              # locks you out if this is the interface you came in on
firewall-cmd --reload                                                    # apply permanent; drops runtime-only changes
firewall-cmd --runtime-to-permanent                                      # save what you tested at runtime
firewall-cmd --add-port=8080/tcp --timeout=300                           # runtime only, removed after 5 minutes: safe for testing remotely
firewall-cmd --zone=public --set-target=DROP --permanent                 # silent drop instead of reject for unmatched traffic
firewall-cmd --panic-on                                                  # drops every packet in and out, including your SSH session; --panic-off

firewall-cmd --permanent --new-service=my-app
firewall-cmd --permanent --service=my-app --set-description='my-app API'
firewall-cmd --permanent --service=my-app --add-port=8080/tcp --add-port=8443/tcp
firewall-cmd --reload && firewall-cmd --zone=public --add-service=my-app --permanent && firewall-cmd --reload

# SSH only from the management subnet, everything else to port 22 dropped by the zone target
firewall-cmd --zone=public --remove-service=ssh --permanent
firewall-cmd --zone=public --add-rich-rule='rule family=ipv4 source address=192.0.2.0/24 service name=ssh accept' --permanent

# Block one host entirely
firewall-cmd --add-rich-rule='rule family=ipv4 source address=203.0.113.7 drop' --permanent

# Reject with a proper ICMP message instead of silently dropping
firewall-cmd --add-rich-rule='rule family=ipv4 source address=198.51.100.0/24 reject type=icmp-admin-prohibited' --permanent

# Rate-limit new SSH connections and log the ones that get through
firewall-cmd --add-rich-rule='rule service name=ssh log prefix="ssh " level=info limit value=5/m accept' --permanent

# Allow a port only from one address, logging every hit
firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.0.2.10 port port=5432 protocol=tcp log prefix="pg " accept' --permanent

# Forward a port only for one source
firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.0.2.0/24 forward-port port=8080 protocol=tcp to-port=80 to-addr=10.0.0.5' --permanent

# Masquerade only for one source range
firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.0/24 masquerade' --permanent

firewall-cmd --list-rich-rules
firewall-cmd --remove-rich-rule='rule family=ipv4 source address=203.0.113.7 drop' --permanent   # exact text to remove

firewall-cmd --zone=public --add-masquerade --permanent            # VMs or containers on an internal zone reach the internet via this host
firewall-cmd --zone=public --add-forward-port=port=443:proto=tcp:toport=8443 --permanent               # local redirect
firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toaddr=192.0.2.10:toport=8080 --permanent   # to another host; needs masquerade or a policy
firewall-cmd --zone=public --list-forward-ports
sysctl net.ipv4.ip_forward                                          # 1 after masquerade; firewalld sets it, no sysctl.d entry needed

firewall-cmd --permanent --new-policy=lan-to-wan
firewall-cmd --permanent --policy=lan-to-wan --add-ingress-zone=internal
firewall-cmd --permanent --policy=lan-to-wan --add-egress-zone=public
firewall-cmd --permanent --policy=lan-to-wan --set-target=ACCEPT
firewall-cmd --permanent --policy=lan-to-wan --add-masquerade                 # or --add-masquerade on the egress zone
firewall-cmd --permanent --new-policy=wan-to-dmz
firewall-cmd --permanent --policy=wan-to-dmz --add-ingress-zone=public --add-egress-zone=dmz
firewall-cmd --permanent --policy=wan-to-dmz --add-rich-rule='rule family=ipv4 destination address=10.0.1.10 port port=443 protocol=tcp accept'
firewall-cmd --reload
firewall-cmd --info-policy=lan-to-wan

firewall-cmd --set-log-denied=all         # off, all, unicast, broadcast, multicast; runtime and permanent at once
firewall-cmd --get-log-denied
journalctl -k -g 'FINAL_REJECT|FINAL_DROP' -f     # firewalld prefixes: FINAL_REJECT for reject zones, FINAL_DROP for drop

nft list ruleset                            # everything, in the syntax you would write it in
nft list tables                             # table names and families
nft list table inet filter
nft list chain inet filter input
nft list ruleset -a                         # with rule handles, needed for delete and insert-at
nft list set inet filter admin_hosts
nft -c -f /etc/nftables/main.nft            # -c: check syntax and semantics, load nothing
nft -f /etc/nftables/main.nft               # load atomically; the file usually starts with flush ruleset
nft add rule inet filter input tcp dport 8080 accept                    # append to a chain at runtime
nft insert rule inet filter input position 0 tcp dport 8080 accept      # at the top
nft add rule inet filter input handle 12 tcp dport 8080 accept          # after handle 12
nft delete rule inet filter input handle 14
nft add element inet filter admin_hosts { 192.0.2.10, 192.0.2.11 }      # extend a set live
nft delete element inet filter admin_hosts { 192.0.2.11 }
nft flush chain inet filter input           # empty a chain (the base chain's policy then applies to everything)
nft flush ruleset                           # DESTRUCTIVE to filtering: removes every table including firewalld's and Docker's
nft list ruleset > /etc/nftables/backup-$(date +%F).nft   # dump in loadable form
nft -j list ruleset | jq                    # JSON
nft monitor                                 # print ruleset changes as they happen

#!/usr/sbin/nft -f
# /etc/nftables/main.nft
flush ruleset

define MGMT_NET6 = { 2001:db8:1::/64 }

table inet filter {
    set admin_hosts {
        type ipv4_addr
        flags interval                       # allows CIDR ranges and ranges like 192.0.2.1-192.0.2.20
        elements = { 192.0.2.0/24 }
    }

    set ssh_meter {
        type ipv4_addr
        flags dynamic, timeout                # per-source rate counters, created on demand
        timeout 1m
    }

    set blocklist {
        type ipv4_addr
        flags dynamic, timeout                # elements expire; filled by the ssh_ratelimit chain below
        timeout 1h
    }

    chain input {
        type filter hook input priority filter; policy drop;

        iif lo accept                                     # loopback
        ct state established,related accept               # replies to our own connections and related ICMP
        ct state invalid drop                             # packets no connection tracking entry explains

        ip saddr @blocklist drop                          # anyone the rate limiter caught
        ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded, parameter-problem } limit rate 10/second accept
        ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert } accept   # IPv6 does not work without ND

        tcp dport 22 ip saddr @admin_hosts ct state new jump ssh_ratelimit
        tcp dport 22 ip saddr @admin_hosts accept
        tcp dport 22 ip6 saddr $MGMT_NET6 accept
        tcp dport { 80, 443 } accept
        udp dport 443 accept                              # HTTP/3

        meta l4proto { tcp, udp } th dport 33434-33534 reject with icmpx type port-unreachable   # traceroute answers
        limit rate 5/second log prefix "nft-input-drop " flags all counter drop   # what the policy would drop; rate-limited so a flood cannot fill the journal
    }

    chain ssh_ratelimit {
        # more than 4 new connections in a minute from one address adds it to the blocklist for an hour
        add @ssh_meter { ip saddr limit rate over 4/minute burst 4 packets } add @blocklist { ip saddr } log prefix "nft-ssh-ratelimit " drop
        return
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        # this host does not route; container and VM forwarding is added in the nat example below
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}

table inet nat {
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        iifname "eth0" tcp dport 443 dnat ip to 10.0.0.10:8443          # inbound 443 to the web VM
        iifname "eth0" tcp dport 2222 dnat ip to 10.0.0.11:22           # SSH to the bastion VM on an alternate port
    }
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 10.0.0.0/24 oifname "eth0" masquerade                  # VMs share the host's public address
        ip saddr 10.0.0.0/24 ip daddr 10.0.0.10 tcp dport 8443 masquerade   # hairpin: VMs reaching the public port get replies via the host
    }
}

table inet filter {
    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
        ct state invalid drop
        iifname "br0" oifname "eth0" accept                                 # VMs to the internet
        iifname "eth0" oifname "br0" ct status dnat accept                  # only inbound traffic that a dnat rule chose
        iifname "br0" oifname "br0" accept                                  # VM to VM on the bridge (or drop for isolation)
        log prefix "nft-forward-drop " limit rate 5/second counter drop
    }
}

table inet nat {
    map port_forwards {
        type inet_service : ipv4_addr . inet_service
        elements = { 443 : 10.0.0.10 . 8443, 2222 : 10.0.0.11 . 22, 8080 : 10.0.0.12 . 80 }
    }
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        iifname "eth0" dnat ip to tcp dport map @port_forwards
    }
}

nft add set inet filter countries { type ipv4_addr\; flags interval\; }
nft add element inet filter countries { 198.51.100.0/24, 203.0.113.0/24 }
nft add rule inet filter input ip saddr @countries drop

# verdict map: one rule, different action per port
nft add rule inet filter input tcp dport vmap { 22 : jump ssh_chain, 80 : accept, 443 : accept, 3306 : drop }

# per-interface dispatch
nft add rule inet filter input iif vmap { "lo" : accept, "eth0" : jump wan_input, "br0" : jump lan_input }

# named counters that survive rule edits
nft add counter inet filter ssh_accepted
nft add rule inet filter input tcp dport 22 counter name ssh_accepted accept
nft list counters

# concatenations: match address and port together
nft add set inet filter allowed { type ipv4_addr . inet_service\; }
nft add element inet filter allowed { 192.0.2.10 . 5432, 192.0.2.11 . 5432 }
nft add rule inet filter input ip saddr . tcp dport @allowed accept

# reset counters
nft reset counters table inet filter

nft insert rule inet filter input position 0 tcp dport 8443 meta nftrace set 1      # mark matching packets at the very top
nft monitor trace                                                                   # in another terminal, then send a test packet
nft delete rule inet filter input handle N                                          # remove the trace rule afterwards; find N with nft list ruleset -a

iptables -L -n -v --line-numbers                     # filter table, numeric, counters
iptables -t nat -L -n -v                             # nat table
iptables -S                                          # rules as add commands
iptables-save > /root/iptables-$(date +%F).rules     # dump all tables in restorable form
iptables-restore < /root/iptables.rules             # atomic load
iptables -A INPUT -p tcp --dport 22 -s 192.0.2.0/24 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT                  # insert at position 1
iptables -D INPUT 3                                  # delete rule 3
iptables -P INPUT DROP                               # default policy
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 10.0.0.10:8443
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 4/min --limit-burst 4 -j ACCEPT
iptables -A INPUT -j LOG --log-prefix 'ipt-drop ' --log-level 4

iptables-translate -A INPUT -p tcp --dport 22 -s 192.0.2.0/24 -j ACCEPT
# nft add rule ip filter INPUT ip saddr 192.0.2.0/24 tcp dport 22 counter accept
iptables-translate -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
# nft add rule ip nat POSTROUTING oifname "eth0" ip saddr 10.0.0.0/24 counter masquerade
iptables-restore-translate -f /root/iptables.rules > /etc/nftables/translated.nft
nft -c -f /etc/nftables/translated.nft

# firewalld
firewall-cmd --permanent --zone=public --remove-service=ssh
firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 source address=192.0.2.0/24 service name=ssh accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule service name=ssh reject'
firewall-cmd --reload
# nftables
nft add rule inet filter input ip saddr 192.0.2.0/24 tcp dport 22 accept
nft add rule inet filter input tcp dport 22 reject with tcp reset

firewall-cmd --permanent --add-rich-rule='rule service name=ssh limit value=4/m accept'         # firewalld: 4 new per minute, rest hit the zone target
nft add rule inet filter input tcp dport 22 ct state new limit rate over 4/minute burst 4 packets drop   # nftables, without the ban set

nft add rule inet filter input ip saddr { 127.0.0.1, 10.0.0.0/24, 10.88.0.0/16 } tcp dport 5432 accept
firewall-cmd --permanent --zone=trusted --add-source=10.88.0.0/16       # firewalld: trust the Podman network entirely

firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=8443
nft add rule inet nat prerouting tcp dport 443 redirect to :8443
nft add rule inet nat output oif lo tcp dport 443 redirect to :8443     # local clients too; needs an output nat chain

table inet filter {
    chain output {
        type filter hook output priority filter; policy drop;
        oif lo accept
        ct state established,related accept
        udp dport 53 ip daddr { 192.0.2.53, 192.0.2.54 } accept        # our resolvers only
        tcp dport { 80, 443 } accept
        udp dport 123 accept                                          # NTP
        log prefix "nft-output-drop " counter drop
    }
}

iptables -I DOCKER-USER -i eth0 ! -s 192.0.2.0/24 -m conntrack --ctdir ORIGINAL -j DROP   # published ports reachable only from the management net
iptables -I DOCKER-USER -i eth0 -p tcp --dport 8080 -j DROP                               # or block one published port from outside
iptables -L DOCKER-USER -n -v

# What is actually open: listening sockets against firewall rules
ss -tulpnH | awk '{print $1, $5}' | sort -u; firewall-cmd --list-ports --list-services

# Runtime and permanent firewalld config differ
diff <(firewall-cmd --list-all) <(firewall-cmd --permanent --list-all)

# Open a port for 10 minutes while testing, then it closes itself
firewall-cmd --add-port=9090/tcp --timeout=600

# Which zone will handle a source address
firewall-cmd --get-zone-of-source=192.0.2.10 || echo 'interface zone applies'

# Move all interfaces from public to drop, safely (source-zone the management net first)
firewall-cmd --permanent --zone=trusted --add-source=192.0.2.0/24 && firewall-cmd --permanent --set-default-zone=drop && firewall-cmd --reload

# Every service firewalld knows that maps to a given port
for s in $(firewall-cmd --get-services); do firewall-cmd --info-service="$s" | grep -q 'ports:.*\b8080/tcp' && echo "$s"; done

# Tail denied packets with a readable format
journalctl -kf -g 'FINAL_(REJECT|DROP)|nft-.*-drop' | grep -oE 'IN=\S+|SRC=\S+|DST=\S+|PROTO=\S+|DPT=\S+' | paste - - - - -

# Top sources being dropped in the last hour
journalctl -k --since -1h -g 'FINAL_|nft-.*-drop' | grep -oP 'SRC=\K\S+' | sort | uniq -c | sort -rn | head

# Dump the live nftables ruleset with counters and handles to a file
nft -a list ruleset > /root/nft-$(date +%FT%H%M).txt

# Reload an nftables file only if it validates
nft -c -f /etc/nftables/main.nft && nft -f /etc/nftables/main.nft

# Try a new ruleset and roll back automatically in 60 s unless cancelled (remote-safe)
nft list ruleset > /root/nft-rollback.nft; (sleep 60 && nft -f /root/nft-rollback.nft) & rb=$!; nft -f /etc/nftables/main.nft; echo "kill $rb to keep"

# Counters for the rules in one chain, sorted by packets
nft -a list chain inet filter input | grep -oE 'counter packets [0-9]+ bytes [0-9]+.*' | sort -k3,3nr | head

# Add an address to a blocklist set for an hour (dynamic set with timeout)
nft add element inet filter blocklist { 203.0.113.7 timeout 1h }

# List the contents of a set with expiry
nft list set inet filter blocklist

# Which table dropped a packet: trace one destination port
nft insert rule inet filter input position 0 tcp dport 8443 meta nftrace set 1; timeout 20 nft monitor trace

# Is IP forwarding on (needed for NAT and containers)
sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding

# Connection tracking table size and usage (drops appear as 'nf_conntrack: table full')
sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max

# Live connection tracking entries to a port
conntrack -L -p tcp --dport 443 2>/dev/null | head    # conntrack-tools package

# Which backend the iptables command uses
iptables -V

# Docker: block a published port from anything but one subnet
iptables -I DOCKER-USER -i eth0 -p tcp --dport 8080 ! -s 192.0.2.0/24 -j DROP

# Docker: show the DNAT rules it wrote
iptables -t nat -S DOCKER

# Podman: the nftables table netavark manages
nft list table inet netavark 2>/dev/null || iptables -S | grep -i netavark

# Test a rule from outside without nmap
timeout 3 bash -c 'echo > /dev/tcp/192.0.2.1/8443' && echo open || echo 'closed or filtered'

# Check whether a port is filtered or closed (RST versus silence); see the nmap page for more
nc -zv -w3 192.0.2.1 8443

# Check for a second, legacy ruleset lurking
iptables-legacy -S 2>/dev/null | grep -v '^-P' || echo 'no legacy rules'

# Persist a firewalld set of changes as an idempotent script
firewall-cmd --permanent --list-all | sed 's/^/# /'; firewall-cmd --permanent --list-rich-rules | sed "s/.*/firewall-cmd --permanent --add-rich-rule='&'/"

#!/usr/bin/env bash
# usage: exposure-audit.sh    (root, firewalld running)
set -euo pipefail
zone=$(firewall-cmd --get-default-zone)
allowed=$(firewall-cmd --zone="$zone" --list-ports | tr ' ' '\n')
for s in $(firewall-cmd --zone="$zone" --list-services); do
  allowed+=$'\n'$(firewall-cmd --info-service="$s" | awk '/ports:/ {for (i = 2; i <= NF; i++) print $i}')
done
printf 'default zone: %s\n\n%-6s %-22s %-8s %s\n' "$zone" PROTO LISTEN ALLOWED PROCESS
ss -tulpnH | while read -r proto _ _ local _ proc; do
  port=${local##*:}; addr=${local%:*}
  case $addr in 127.*|\[::1\]) continue ;; esac                                  # loopback is not exposed
  p=${proto%6}                                                                   # tcp6 -> tcp
  if grep -qx "$port/$p" <<< "$allowed"; then ok=yes; else ok=NO; fi
  printf '%-6s %-22s %-8s %s\n' "$proto" "$local" "$ok" "$(grep -oP 'users:\(\("\K[^"]+' <<< "$proc" | head -1)"
done | sort -k3

#!/usr/bin/env bash
# usage: apply-firewall.sh policy.conf
# policy.conf lines:  zone public service https | zone public port 8443/tcp | zone trusted source 192.0.2.0/24 | rich public rule ... | masquerade public
set -euo pipefail
conf=${1:?policy file required}
run() { printf '+ firewall-cmd --permanent %s\n' "$*"; firewall-cmd --permanent "$@" >/dev/null; }

# reset the zones the file mentions to their shipped defaults so removed lines really go away
for z in $(awk '$1 == "zone" || $1 == "rich" || $1 == "masquerade" {print $2}' "$conf" | sort -u); do
  run --load-zone-defaults="$z" 2>/dev/null || echo "zone $z has no defaults to load (custom zone), continuing" >&2
done
while read -r kind zone what value; do
  case $kind in
    ''|'#'*) continue ;;
    zone) run --zone="$zone" --add-"$what"="$value" ;;              # service, port, source, interface
    rich) run --zone="$zone" --add-rich-rule="$what $value" ;;
    masquerade) run --zone="$zone" --add-masquerade ;;
    *) echo "unknown line: $kind $zone $what $value" >&2; exit 2 ;;
  esac
done < "$conf"
firewall-cmd --reload && firewall-cmd --list-all-zones | grep -B1 -A12 'active'

#!/usr/bin/env bash
# usage: sync-blocklist.sh /etc/nftables/blocklist.txt   (one CIDR or address per line; # comments)
set -euo pipefail
src=${1:?list file required}
tmp=$(mktemp); trap 'rm -f -- "$tmp"' EXIT

mapfile -t cidrs < <(grep -Ev '^\s*(#|$)' "$src" | grep -E '^([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?$')
(( ${#cidrs[@]} )) || { echo 'no valid IPv4 entries' >&2; exit 1; }
{
  printf 'table inet filter {\n  set blocklist_v4 {\n    type ipv4_addr\n    flags interval\n  }\n}\n'   # ensure the set exists; a no-op if it does
  printf 'flush set inet filter blocklist_v4\n'
  printf 'add element inet filter blocklist_v4 { %s }\n' "$(IFS=,; echo "${cidrs[*]}")"
} > "$tmp"
nft -c -f "$tmp" && nft -f "$tmp"                                    # one transaction: flush and refill
printf 'loaded %d entries into inet filter blocklist_v4\n' "${#cidrs[@]}"
nft list chain inet filter input | grep -q '@blocklist_v4' || echo 'note: no rule references @blocklist_v4 yet' >&2