A rule can be fixed right in the kernel, but the next load brings it back from the file. So you edit the file, check it and load it.
The server's rules live in /opt/firewall-lab/rules.nft. The file's first line is flush ruleset: loading it wipes every rule in the lab-server namespace and recreates them from the file. That is why it is loaded only there, through ip netns exec lab-server.
| Command | What it does |
|---|---|
nft -c -f rules.nft |
checks the file without changing the rules |
nft -f rules.nft |
loads the file into the kernel |
A file that is saved but not loaded is invisible to the kernel. The -c check catches writing mistakes: rules.nft:4:23-23: Error: syntax error means line 4, column 23.
Fix the permission
In /opt/firewall-lab/rules.nft, fix the permission for 192.0.2.20 so that it gets the site on port 8080. Check the file, load it into lab-server and test from both sides: 192.0.2.20 gets /health, 192.0.2.30 does not.
Goals · 0 of 2
- Fix the permission in rules.nft not done yet
- Load the rules: .20 gets the site, .30 does not not done yet