HowTo: nftables firewall on Debian

nftables replaces iptables on modern Debian. A clean ruleset with commands: drop policy, allowed services, IP sets, SSH rate-limit and persistence.

1. Install

sudo apt update && sudo apt -y install nftables
sudo systemctl enable nftables

2. Base ruleset (/etc/nftables.conf)

sudo tee /etc/nftables.conf >/dev/null <<'EOF'
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif "lo" accept
    ct state established,related accept
    ct state invalid drop
    ip protocol icmp accept
    tcp dport 22 accept
    tcp dport { 80, 443 } accept
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output  { type filter hook output priority 0; policy accept; }
}
EOF

3. Check and apply

sudo nft -c -f /etc/nftables.conf   # verifica sintaxa
sudo systemctl restart nftables
sudo nft list ruleset

4. Blocklist IP set

# set de IP-uri blocate (interval) + regula de drop
sudo nft add set inet filter blocklist '{ type ipv4_addr; flags interval; }'
sudo nft add rule inet filter input ip saddr @blocklist drop
sudo nft add element inet filter blocklist '{ 203.0.113.0/24, 198.51.100.7 }'

5. SSH rate-limit

# limiteaza noile conexiuni SSH: max 4 / minut / IP
sudo nft add rule inet filter input tcp dport 22 ct state new \
  meter ssh_meter '{ ip saddr limit rate 4/minute }' accept
sudo nft add rule inet filter input tcp dport 22 ct state new drop

6. Logging for dropped packets

# logheaza ce pica (rate-limited ca sa nu inunde)
sudo nft add rule inet filter input limit rate 5/minute log prefix \"nft-drop \" 
sudo journalctl -k -g nft-drop --no-pager | tail

7. Verify

sudo nft list ruleset
sudo nft list set inet filter blocklist
sudo systemctl status nftables --no-pager

NAT and port-forward

If the server is also a gateway, add a NAT table: masquerade to share the internet to the LAN and DNAT to forward a public port to an internal host.

table ip nat {
  chain postrouting {
    type nat hook postrouting priority 100;
    oif "eth0" masquerade          # partajare internet catre LAN
  }
  chain prerouting {
    type nat hook prerouting priority -100;
    iif "eth0" tcp dport 80 dnat to 10.0.0.5:8080   # port-forward
  }
}

Conclusion

You now have an nftables firewall with a default drop policy, persistent across reboots. NOTE: keep SSH allowed before applying so you don't lock yourself out.