tollan/nftables repository overview

# SSH access
ssh root@<container_ip>
# Password: pass

# Or use GNS3 console

# Apply sysctl settings
sysctl -p

# Start logging service
rsyslogd

# Load nftables rules
nft -f /etc/nftables.conf

# Start SSH service
/usr/sbin/sshd -D

# Check nftables version
nft --version

# List current ruleset
nft list ruleset

# List specific table
nft list table inet filter

# List specific chain
nft list chain inet filter input

# Create a table
nft create table inet filter

# Create chains
nft create chain inet filter input { type filter hook input priority 0 \; }
nft create chain inet filter forward { type filter hook forward priority 0 \; }
nft create chain inet filter output { type filter hook output priority 0 \; }

# Set default policies
nft add rule inet filter input policy drop
nft add rule inet filter forward policy drop
nft add rule inet filter output policy accept

# Allow loopback
nft add rule inet filter input iif lo accept
nft add rule inet filter output oif lo accept

# Allow established connections
nft add rule inet filter input ct state established,related accept

# Allow SSH
nft add rule inet filter input tcp dport 22 accept

# Allow ping
nft add rule inet filter input icmp type echo-request accept

# Allow specific network
nft add rule inet filter input ip saddr 192.168.1.0/24 accept

# Block specific IP
nft add rule inet filter input ip saddr 192.168.1.100 drop

# Allow port range
nft add rule inet filter input tcp dport 8000-9000 accept

# Log dropped packets
nft add rule inet filter input log prefix "DROPPED: " drop

# Create NAT table
nft create table inet nat

# Create NAT chains
nft create chain inet nat prerouting { type nat hook prerouting priority 0 \; }
nft create chain inet nat postrouting { type nat hook postrouting priority 100 \; }

# SNAT (Source NAT)
nft add rule inet nat postrouting oifname eth0 masquerade

# DNAT (Destination NAT)
nft add rule inet nat prerouting tcp dport 80 dnat to 192.168.1.10:80

# Save current ruleset
nft list ruleset > /etc/nftables.conf

# Load rules from file
nft -f /etc/nftables.conf

# Flush all rules
nft flush ruleset

#!/usr/sbin/nft -f

# Flush existing rules
flush ruleset

# Create table
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        
        # Allow loopback
        iif lo accept
        
        # Allow established connections
        ct state established,related accept
        
        # Allow SSH
        tcp dport 22 accept
        
        # Allow ping
        icmp type echo-request accept
        
        # Log and drop everything else
        log prefix "DROPPED: " drop
    }
    
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

# Test from another container
ping <firewall_ip>
nmap -p 22,80,443 <firewall_ip>

# Monitor traffic
tcpdump -i any host <target_ip>

# Check connection tracking
cat /proc/net/nf_conntrack