Mastering Linux Security and Hardening - Second Edition

Configuring nftables on Ubuntu 16.04

If you ever need to work with the older Ubuntu 16.04, you'll see that the default nftables.conf file in the /etc directory already has the beginnings of a basic nft firewall configuration:

#!/usr/sbin/nft -f flush ruleset table inet filter {  chain input {  type filter hook input priority 0;  iif lo accept  ct state established,related accept  # tcp dport { 22, 80, 443 } ct state new accept  ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept  counter drop  } } 

We'll look at how to work with this in just a bit.