HowTo: firewall nftables pe Debian

nftables inlocuieste iptables pe Debian modern. Un ruleset curat: politica drop, servicii permise, seturi de IP-uri, rate-limit SSH si persistenta.

1. Instalare

sudo apt update && sudo apt -y install nftables
sudo systemctl enable nftables

2. Ruleset de baza (/etc/nftables.conf)

sudo tee /etc/nftables.conf >/dev/null <<'EOF'
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif "lo" accept
    ct state established,related accept
    ct state invalid drop
    ip protocol icmp accept
    tcp dport 22 accept
    tcp dport { 80, 443 } accept
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output  { type filter hook output priority 0; policy accept; }
}
EOF

3. Verifica si aplica

sudo nft -c -f /etc/nftables.conf   # verifica sintaxa
sudo systemctl restart nftables
sudo nft list ruleset

4. Set de IP-uri blocate

# set de IP-uri blocate (interval) + regula de drop
sudo nft add set inet filter blocklist '{ type ipv4_addr; flags interval; }'
sudo nft add rule inet filter input ip saddr @blocklist drop
sudo nft add element inet filter blocklist '{ 203.0.113.0/24, 198.51.100.7 }'

5. Rate-limit pe SSH

# limiteaza noile conexiuni SSH: max 4 / minut / IP
sudo nft add rule inet filter input tcp dport 22 ct state new \
  meter ssh_meter '{ ip saddr limit rate 4/minute }' accept
sudo nft add rule inet filter input tcp dport 22 ct state new drop

6. Logging pentru pachetele picate

# logheaza ce pica (rate-limited ca sa nu inunde)
sudo nft add rule inet filter input limit rate 5/minute log prefix \"nft-drop \" 
sudo journalctl -k -g nft-drop --no-pager | tail

7. Verificare

sudo nft list ruleset
sudo nft list set inet filter blocklist
sudo systemctl status nftables --no-pager

NAT si port-forward

Daca serverul e si gateway, adaugi un tabel NAT: masquerade pentru a partaja internetul catre LAN si DNAT pentru a redirectiona un port public catre un host intern.

table ip nat {
  chain postrouting {
    type nat hook postrouting priority 100;
    oif "eth0" masquerade          # partajare internet catre LAN
  }
  chain prerouting {
    type nat hook prerouting priority -100;
    iif "eth0" tcp dport 80 dnat to 10.0.0.5:8080   # port-forward
  }
}

Concluzie

Ai un firewall nftables cu politica implicita drop, persistent la reboot. ATENTIE: pastreaza SSH permis inainte de a aplica, ca sa nu te blochezi.