A modern Linux firewall is more than iptables with static rules.
Essential components
- nftables / iptables ruleset
- GeoIP filtering
- IP reputation lists (CrowdSec, AbuseIPDB, Spamhaus, Tor)
- fail2ban
- Rate limiting
- Port knocking
Visibility with NetFlow / sFlow / IPFIX
Top talkers, abnormal connections, exfiltration patterns, ongoing attacks, compliance reporting.
What we deliver
Hardened firewall, automatic blocklist updates, Grafana dashboard, Telegram/email alerting.
Example: ruleset + NetFlow
Reputation-set blocking and NetFlow export to a collector:
# nftables: default drop + GeoIP set + export NetFlow
nft add rule inet filter input ip saddr @blocklist drop
# NetFlow catre colector (softflowd -> nfdump/ntopng):
sudo apt -y install softflowd
sudo softflowd -i eth0 -n 10.0.0.50:2055