Linux Networking: Firewalls, NAT, and Netfilter

sudo nft list ruleset

# Display the active nftables ruleset.

sudo nft add table inet filter

# Create an inet filter table.

sudo nft 'add chain inet filter input { type filter hook input priority 0; policy drop; }'

# Create an input chain with a default policy.

sudo nft add rule inet filter input tcp dport 22 ct state new,established accept

# Permit inbound SSH traffic.

sudo iptables -L -n -v

# Show IPv4 filter rules with counters.

sudo iptables-save

# Dump current iptables rules in restore format.

sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPT

# Insert a rule allowing inbound SSH.

sudo iptables -A INPUT -s 203.0.113.25 -j DROP

# Block all inbound traffic from a source IP.

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Apply source NAT for outbound traffic.

sudo ufw status verbose

# Inspect uncomplicated firewall status and rules.

sudo ufw allow 443/tcp

# Allow inbound TCP on a specific port.

sudo firewall-cmd --list-all

# Show active firewalld zones and services.

sudo firewall-cmd --permanent --add-service=https && sudo firewall-cmd --reload

# Permanently allow the HTTPS service.

sudo conntrack -L

# Inspect conntrack table entries.

sudo conntrack -D -p tcp --orig-src 10.0.0.10 --orig-dst 10.0.0.20

# Remove conntrack state for a given flow.

sudo iptables -Z

# Zero rule counters before testing packet paths.

sudo nft monitor trace

# Monitor nftables trace events for debugging.

sysctl net.ipv4.ip_forward

# Inspect whether packet forwarding is enabled.

sudo sysctl -w net.ipv4.ip_forward=1

# Turn on IPv4 forwarding immediately.