bash
sudo nft list rulesetNotes
Display the active nftables ruleset.
Linux Networking: Firewalls, NAT, and Netfilter
nftables, iptables, ufw, firewalld, conntrack, and packet flow debugging commands.
Export
Copy the compact sheet, download it, or print it.
Download
`D` dense toggle · `C` copy all
Firewalling with nftables and iptables
Inspect and manage packet filtering and NAT.
bash
sudo nft add table inet filterNotes
Create an inet filter table.
bash
sudo nft 'add chain inet filter input { type filter hook input priority 0; policy drop; }'Notes
Create an input chain with a default policy.
bash
sudo nft add rule inet filter input tcp dport 22 ct state new,established acceptNotes
Permit inbound SSH traffic.
bash
sudo iptables -L -n -vNotes
Show IPv4 filter rules with counters.
bash
sudo iptables-saveNotes
Dump current iptables rules in restore format.
bash
sudo iptables -I INPUT -p tcp --dport 22 -j ACCEPTNotes
Insert a rule allowing inbound SSH.
bash
sudo iptables -A INPUT -s 203.0.113.25 -j DROPNotes
Block all inbound traffic from a source IP.
bash
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADENotes
Apply source NAT for outbound traffic.
bash
sudo ufw status verboseNotes
Inspect uncomplicated firewall status and rules.
bash
sudo ufw allow 443/tcpNotes
Allow inbound TCP on a specific port.
bash
sudo firewall-cmd --list-allNotes
Show active firewalld zones and services.
bash
sudo firewall-cmd --permanent --add-service=https && sudo firewall-cmd --reloadNotes
Permanently allow the HTTPS service.
Netfilter and Policy Debugging
Inspect conntrack, counters, and common packet flow issues.
bash
sudo conntrack -LNotes
Inspect conntrack table entries.
bash
sudo conntrack -D -p tcp --orig-src 10.0.0.10 --orig-dst 10.0.0.20Notes
Remove conntrack state for a given flow.
Reset iptables counters
Zero rule counters before testing packet paths.
bashLINUXiptablescountersdebug
bash
sudo iptables -ZNotes
Zero rule counters before testing packet paths.
bash
sudo nft monitor traceNotes
Monitor nftables trace events for debugging.
bash
sysctl net.ipv4.ip_forwardNotes
Inspect whether packet forwarding is enabled.
bash
sudo sysctl -w net.ipv4.ip_forward=1Notes
Turn on IPv4 forwarding immediately.
More in Linux Networking
Linux Networking: Troubleshooting and Diagnostics
Reachability, latency, DNS, proxy, logs, and real-time diagnostics for Linux network incidents.
Linux Networking: DNS, HTTP, and TLS Testing
DNS troubleshooting, resolver inspection, HTTP probing, and TLS certificate testing from Linux.
Linux Networking: Routing, VLANs, Bridges, and Tunnels
Linux routing tables, policy routing, bridges, VLANs, bonds, and tunnel configuration commands.
Linux Networking Cheat Sheet
Comprehensive Linux networking commands for interfaces, sockets, packet capture, and throughput testing.