Linux Labs
Linux Labs
EN

Networking / Stage 7 of 14

Allow what is needed, keep the block

Not running Starting usually ~20 s
Leave the lesson

Step 2 of 8 · on a machine · 4 min

Table, chain, rule

The server itself drops the client's packets — with its filter made of tables, chains and rules.

A firewall lets packets through or drops them by rules. In Linux the kernel holds the rules, and the nft program from the nftables suite sets them. Read the server's rules:

bash 
sudo ip netns exec lab-server nft list ruleset

The output looks like this, only the counter numbers on your machine differ:

text 
table inet lab_filter {
	chain input {
		type filter hook input priority filter; policy drop;
		iif "lo" accept
		ip saddr 192.0.2.20 tcp dport 8081 counter packets 0 bytes 0 accept
		counter packets 4 bytes 264 drop
	}
}

The table lab_filter groups chains; inet means it covers IPv4 and IPv6 at once. The chain input is a list of rules for packets addressed to the machine itself: the hook input line attaches it that way. Packets the machine sends itself go through a chain with hook output, and packets it passes on through one with hook forward.

Without sudo, nft prints Operation not permitted (you must be root).

Check yourself 1 question

The site runs on the server itself, and the client comes to it over the network. Which chain holds the rule that cuts requests to the site?

  • forward is for packets the machine passes on, like a router. A request to the site is addressed to the server itself.

  • output is for packets the server sends itself. The client's request comes into the server.

Packets addressed to the machine itself go through the chain with hook input; on the practice server that is input in the lab_filter table. Packets passed on go through forward, and those the machine sends through output.

Key points

  • nft sets the firewall rules, and sudo nft list ruleset reads them.
  • A table groups chains and a chain holds rules; hook input is for packets addressed to the machine itself.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…