Firewalling Basics - Revision history

KN6DWI: Added diagram of table, chain, and rule hierarchy

2026-07-22T23:26:36Z

Added diagram of table, chain, and rule hierarchy

← Older revision		Revision as of 23:26, 22 July 2026
Line 21:		Line 21:

	=== nftables ===		=== nftables ===
	nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the <code>nft</code> command line tool as well as editing <code>/etc/nftables.conf</code>. Changes made with the <code>nft</code> tool will not persist between reboots, and must be written into the config file to ensure persistence.		nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the <code>nft</code> command line tool as well as editing <code>/etc/nftables.conf</code>. Changes made with the <code>nft</code> tool will not persist between reboots, and must be written into the config file to ensure persistence. It functions similarly to <code>iptables</code>, employing tables of chains of rules, but with no predefined chains and more flexible rules.

			[[ File:Netfilter.png \| 500px \| A diagram illustrating the table, chain, and rule hierarchy used by iptables and nftables. A packet proceeds into the table, through the first chain, and does not match any rules. It proceeds through the second chain, matches the second rule, and makes a routing decision. ]]

	== High Level Tools ==		== High Level Tools ==
	=== firewalld ===		=== firewalld ===
	=== ufw ===		=== ufw ===

KN6DWI: Described nftables

2026-07-22T22:53:55Z

Described nftables

← Older revision		Revision as of 22:53, 22 July 2026
Line 21:		Line 21:

	=== nftables ===		=== nftables ===
			nftables is the currently maintained Linux firewall rule management tool. It interfaces with the Linux kernel via the netfilter framework, and can be administrated with the <code>nft</code> command line tool as well as editing <code>/etc/nftables.conf</code>. Changes made with the <code>nft</code> tool will not persist between reboots, and must be written into the config file to ensure persistence.

	== High Level Tools ==		== High Level Tools ==
	=== firewalld ===		=== firewalld ===
	=== ufw ===		=== ufw ===

KN6DWI: Described how iptables is now translated to nftables

2026-07-22T18:46:02Z

Described how iptables is now translated to nftables

← Older revision		Revision as of 18:46, 22 July 2026
Line 16:		Line 16:
	== Low Level Tools ==		== Low Level Tools ==
	=== iptables ===		=== iptables ===
	<code>iptables</code> is a Linux firewall rule management tool that was deprecated in favor of <code>nftables</code> in 2014. It allows system administrators to define ''tables'' containing ''chains'' of ''rules'' for the treatment of packets. (To Do: Add Wikipedia citation)		<code>iptables</code> is a Linux firewall rule management tool that was deprecated in favor of <code>nftables</code> in 2014. It allows system administrators to define ''tables'' containing ''chains'' of ''rules'' for the treatment of packets. (To Do: Add Wikipedia citation) Both <code>iptables</code> and <code>nftables</code> use the netfilter framework to interface with the Linux kernel.

			Modern systems no longer ship with an actual copy of <code>iptables</code>, instead using a compatibility layer that translates its rules to <code>nftables</code>.

	=== nftables ===		=== nftables ===

KN6DWI: Cited iptables and nftables as examples of stateful firewalls

2026-07-22T17:02:02Z

Cited iptables and nftables as examples of stateful firewalls

← Older revision		Revision as of 17:02, 22 July 2026
Line 8:		Line 8:

	=== Stateful Firewalls ===		=== Stateful Firewalls ===
	Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic.		Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls, such as those based on <code>iptables</code> or <code>nftables</code>, are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic.

	Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.		Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.

KN6DWI: Add that connection tracking allowing default policy bypass can be overridden with explicit policy

2026-07-22T16:56:01Z

Add that connection tracking allowing default policy bypass can be overridden with explicit policy

← Older revision		Revision as of 16:56, 22 July 2026
Line 8:		Line 8:

	=== Stateful Firewalls ===		=== Stateful Firewalls ===
	Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if ~~that traffic might not~~ have otherwise ~~been allowed~~. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls are stateful.		Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if the default policy would have otherwise dropped it. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls are stateful. If for some reason this behavior is undesirable, it can be overridden with rules that explicitly drop the unwanted external traffic.

	Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.		Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.

KN6DWI: Phrasing improvement

2026-07-22T16:53:15Z

Phrasing improvement

← Older revision		Revision as of 16:53, 22 July 2026
Line 8:		Line 8:

	=== Stateful Firewalls ===		=== Stateful Firewalls ===
	Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if that traffic might not otherwise ~~have~~ been allowed ~~if the external device was initiating the connection~~. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls are stateful.		Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if that traffic might not have otherwise been allowed. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls are stateful.

	Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.		Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.

KN6DWI: Created iptables and nftables sections

2026-07-22T01:10:21Z

Created iptables and nftables sections

← Older revision		Revision as of 01:10, 22 July 2026
Line 14:		Line 14:
	Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it's completely unrelated to all other packets.		Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it's completely unrelated to all other packets.

	== Low Level Tools: ~~iptables and~~ nftables ==		== Low Level Tools ==
			=== iptables ===
			<code>iptables</code> is a Linux firewall rule management tool that was deprecated in favor of <code>nftables</code> in 2014. It allows system administrators to define ''tables'' containing ''chains'' of ''rules'' for the treatment of packets. (To Do: Add Wikipedia citation)

			=== nftables ===

	== High Level Tools ==		== High Level Tools ==
	=== firewalld ===		=== firewalld ===
	=== ufw ===		=== ufw ===

KN6DWI: Discussed the ways typical firewall goals are achieved

2026-07-21T23:20:49Z

Discussed the ways typical firewall goals are achieved

← Older revision		Revision as of 23:20, 21 July 2026
Line 4:		Line 4:
	== What does a firewall do? ==		== What does a firewall do? ==
	At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet's source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device.		At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet's source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device.

			Outside connections to a public-facing service are typically allowed using a firewall rule that accepts all packets on the port that service is using, regardless of the packet's source IP. Private services, such as those only intended for your LAN, are typically protected by a firewall rule that only accepts packets whose source IP is inside your LAN. Packets sent to that port that originate externally will be dropped. You may have services that are only meant to be accessed from <code>localhost</code>, such as control interfaces accessed only by other software on the same device.

	=== Stateful Firewalls ===		=== Stateful Firewalls ===

KN6DWI: Added that most modern firewalls are stateful

2026-07-21T22:37:18Z

Added that most modern firewalls are stateful

← Older revision		Revision as of 22:37, 21 July 2026
Line 6:		Line 6:

	=== Stateful Firewalls ===		=== Stateful Firewalls ===
	Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if that traffic might not otherwise have been allowed if the external device was initiating the connection. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules.		Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if that traffic might not otherwise have been allowed if the external device was initiating the connection. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules. Most modern firewalls are stateful.

	Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.		Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.

KN6DWI: /* Stateful vs Stateless Firewalls */

2026-07-21T22:36:32Z

Stateful vs Stateless Firewalls

← Older revision		Revision as of 22:36, 21 July 2026
Line 5:		Line 5:
	At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet's source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device.		At its most basic, a firewall inspects incoming and outgoing packets, and based on its set of rules, decides whether each packet should be allowed through, dropped, or diverted. Rules may consider a packet's source and destination IP, source and destination interface, port, protocol (TCP vs UDP), or various special flags that may be set. Basic firewall usage is primarily concerned with source/destination IP, source/destination interface, and port. There are several goals we can achieve via firewall rules: allow outside connections to public-facing services, block outside connections to private services, and in case your device is compromised, block outgoing malicious traffic originating from your device.

	=== Stateful ~~vs Stateless~~ Firewalls ===		=== Stateful Firewalls ===
			Stateful firewalls are capable of remembering information about previous packets, and using it when making later decisions. The most common use for this is connection tracking, a feature enabled by default on many firewalls. Connection tracking remembers when a trusted device, usually one inside your LAN, has initiated a connection to an external device. When the return traffic from the external device comes in, it will be allowed through the firewall, even if that traffic might not otherwise have been allowed if the external device was initiating the connection. It's important to remember this feature when testing your firewall. Even if your device is able to initiate connections to an untrusted device on the outside of your firewall, that device may not be able to initiate a connection to your device, depending on your firewall rules.

			Stateful firewalls also enable various advanced security features that are outside the scope of this guide, such as those utilizing TCP sequence numbers.

			Stateless firewalls are not capable of remembering previous packets, and handle each packet as if it's completely unrelated to all other packets.

	== Low Level Tools: iptables and nftables ==		== Low Level Tools: iptables and nftables ==