LFCA 48 🐧 Firewalls — What They Do - KandZ

A firewall is the control point between the trusted and the untrusted. It inspects the packets that cross the boundary, and it decides which ones pass and which ones are dropped. Every server that faces the internet has a firewall, and every host that runs the sensitive services has one. The firewall is the first line of defense against the unauthorized access, the port scan, and the denial of service. On Linux, the firewall is the kernel’s netfilter framework, and the two tools that configure it are iptables (the legacy) and nftables (the modern). The two use the same kernel’s hooks, but the modern’s syntax and data structures are cleaner. This chapter covers what a firewall does, the packet’s path through the kernel’s hooks, the concepts of the table, the chain, and the rule, the connection’s tracking, the default policy, the stateful’s filtering, and the two tools’ relationship. It builds on LFCA 41 through 47 and prepares the ground for the iptables’ and the nftables’ configuration’s material.

Key point: A firewall is the packet’s filter. It inspects the packets at the kernel’s hooks, and it applies the rules from the tables and the chains. The filter table is the default, and the INPUT, the OUTPUT, and the FORWARD are its chains. The INPUT is the incoming’s, the OUTPUT is the outgoing’s, and the FORWARD is the transit’s. The nat table is the address translation’s, and the PREROUTING, the POSTROUTING, the OUTPUT are its chains. The mangle table is the packet’s alteration’s, and the raw table is the connection’s tracking’s exception. The connection’s tracking (the conntrack) tracks the connections’ state, and the stateful’s rules use the ESTABLISHED, the RELATED, the NEW, the INVALID. The default policy is the chain’s fallback, and the DROP is the silent, the REJECT is the notified, the ACCEPT is the pass. The iptables is the legacy, and the nftables is the modern.

Why a firewall is needed

A host that is connected to a network has the services that listen on the ports. The SSH’s 22, the HTTP’s 80, the HTTPS’s 443, the database’s 5432 — each is the listener, and each is the entry’s point. The firewall decides which of the listeners are the reachable’s, and which are the blocked’s.

The exposure’s problem. A service that listens on the 0.0.0.0 is the every interface’s, and the every is the exposure’s. The firewall is the restriction, and the restriction is the security’s.

The trust’s boundary. The firewall is the boundary’s, and the boundary’s is the trust’s. The internal’s network is the trusted’s, and the internet’s is the untrusted’s. The firewall’s rules are the policy’s, and the policy’s is the boundary’s.

The layers’s defense. The firewall is the defense’s layer, and the layer’s is the depth’s. The firewall, the authentication, the encryption, the updates are the layers, and the layers are the depth’s. The two are the pair, and the pair is the security’s.

Why the firewall is not the only’s. The firewall is not the only’s, and the only’s is the misconception. The firewall is the layer’s, and the layer’s is the depth’s. The two are the pair, and the pair is the defense’s.

Why the firewall matters for the audit. The firewall’s rules are the audit’s, and the audit’s is the review’s. The rules’s list is the policy’s, and the policy’s is the documented’s. The two are the pair, and the pair is the compliance’s.

Why the firewall matters for the compliance. The compliance’s is the firewall’s, and the firewall’s is the requirement’s. The PCI-DSS, the HIPAA, the GDPR are the compliance’s, and the compliance’s is the firewall’s. The two are the pair, and the pair is the requirement’s.

Why the firewall is the kernel’s. The firewall is the kernel’s, and the kernel’s is the netfilter’s. The netfilter is the framework’s, and the framework’s is the hooks’s. The two are the pair, and the pair is the implementation’s.

Why the firewall’s tools matter. The tools are the iptables and the nftables, and the two are the front’s. The kernel’s is the netfilter, and the netfilter’s is the back’s. The two are the pair, and the pair is the implementation’s.

Why the firewall’s rules should be the minimal. The minimal’s is the least’s, and the least’s is the privilege’s. The every’s rule is the risk’s, and the risk’s is the minimal’s. The two are the pair, and the pair is the design’s.

The netfilter’s hooks

The netfilter is the kernel’s framework, and the hooks are its points. The packet passes through the hooks, and the rules at the hooks decide the packet’s fate.

The five hooks. The PREROUTING, the INPUT, the the FORWARD, the OUTPUT, the POSTROUTING. The five are the hooks, and the five are the packet’s path’s.

The packet's path:

  The incoming's packet:
    The NIC ──► the PREROUTING ──► the routing's decision
      │
      ├── The local's ──► the INPUT ──► the local's process
      │
      └── The transit's ──► the FORWARD ──► the POSTROUTING ──► the NIC

  The outgoing's packet:
    The local's process ──► the OUTPUT ──► the routing's decision
      │
      └── the POSTROUTING ──► the NIC

The PREROUTING. The PREROUTING is the incoming’s, and the incoming’s is the before’s. The packet arrives from the NIC, and the PREROUTING is the first’s hook. The destination’s NAT is the PREROUTING‘s, and the DNAT is the common’s.

Why the PREROUTING matters. The PREROUTING is the first’s, and the first’s is the before’s. The destination’s NAT is the PREROUTING‘s, and the DNAT is the port forward’s. The two are the pair, and the pair is the NAT’s.

The INPUT. The INPUT is the local’s, and the local’s is the destination’s. The packet is the local’s process, and the INPUT is the hook’s. The filter‘s INPUT chain is the common’s, and the SSH’s restriction is the example’s.

Why the INPUT matters. The INPUT is the local’s, and the local’s is the server’s. The INPUT‘s rules are the server’s, and the server’s is the exposure’s. The two are the pair, and the pair is the filter’s.

The FORWARD. The FORWARD is the transit’s, and the transit’s is the router’s. The packet is the other’s host, and the FORWARD is the hook’s. The router’s is the FORWARD‘s, and the forward’s is the transit’s.

Why the FORWARD matters. The FORWARD is the transit’s, and the transit’s is the router’s. The router’s is the packet’s, and the packet’s is the other’s. The two are the pair, and the pair is the forward’s.

The OUTPUT. The OUTPUT is the local’s, and the local’s is the source’s. The packet is the local’s process, and the OUTPUT is the hook’s. The filter‘s OUTPUT chain is the common’s, and the outgoing’s restriction is the example’s.

Why the OUTPUT matters. The OUTPUT is the local’s, and the local’s is the source’s. The OUTPUT‘s rules are the source’s, and the source’s is the outbound’s. The two are the pair, and the pair is the filter’s.

The POSTROUTING. The POSTROUTING is the outgoing’s, and the outgoing’s is the after’s. The packet is the last’s hook, and the POSTROUTING is the hook’s. The source’s NAT is the POSTROUTING‘s, and the SNAT and the MASQUERADE are the common’s.

Why the POSTROUTING matters. The POSTROUTING is the last’s, and the last’s is the after’s. The source’s NAT is the POSTROUTING‘s, and the MASQUERADE is the NAT’s. The two are the pair, and the pair is the NAT’s.

Why the hooks matter. The hooks are the packet’s path’s, and the path’s is the rule’s. The five are the pair, and the pair is the netfilter’s. The two are the pair, and the pair is the model’s.

The tables

The netfilter has the tables, and the tables are the rule’s groups. The filter, the nat, the mangle, the raw, the security are the five.

The filter table. The filter is the default’s, and the default’s is the packet’s filtering. The INPUT, the FORWARD, the OUTPUT are the chains, and the three are the filter’s.

Why the filter matters. The filter is the default’s, and the default’s is the common’s. The INPUT‘s rules are the server’s, and the server’s is the filter’s. The two are the pair, and the pair is the firewall’s.

The nat table. The nat is the address translation’s, and the translation’s is the NAT’s. The PREROUTING, the OUTPUT, the POSTROUTING are the chains, and the three are the NAT’s.

Why the nat matters. The nat is the NAT’s, and the NAT’s is the translation’s. The DNAT is the port forward’s, and the SNAT and the MASQUERADE are the outgoing’s. The two are the pair, and the pair is the router’s.

The mangle table. The mangle is the packet’s alteration’s, and the alteration’s is the header’s. The PREROUTING, the INPUT, the FORWARD, the OUTPUT, the POSTROUTING are the chains, and the five are the mangle’s.

Why the mangle matters. The mangle is the alteration’s, and the alteration’s is the TTL’s and the QoS’s. The mangle is the advanced’s, and the advanced’s is the rare’s. The two are the pair, and the pair is the specific’s.

The raw table. The raw is the connection’s tracking’s exception’s, and the exception’s is the NOTRACK‘s. The PREROUTING, the OUTPUT are the chains, and the two are the raw’s.

Why the raw matters. The raw is the exception’s, and the exception’s is the NOTRACK‘s. The raw is the performance’s, and the performance’s is the high’s. The two are the pair, and the pair is the specific’s.

The security table. The security is the SELinux’s, and the SELinux’s is the mandatory’s. The INPUT, the FORWARD, the OUTPUT are the chains, and the three are the security’s.

Why the security matters. The security is the SELinux’s, and the SELinux’s is the specific’s. The security is the rare’s, and the rare’s is the distribution’s. The two are the pair, and the pair is the SELinux’s.

Why the tables matter. The tables are the rule’s groups, and the groups are the purpose’s. The five are the common, and the common is the vocabulary. The two are the pair, and the pair is the model’s.

The chains

A chain is the rule’s list, and the list is the order’s. The packet traverses the chain, and the chain’s rules decide the packet’s fate.

The chain’s traversal. The packet enters the chain, and the rules are the checked’s in the order. The first’s match is the rule’s, and the rule’s is the action’s. The action is the ACCEPT, the DROP, the REJECT, the JUMP, the RETURN.

Why the order matters. The order is the first’s, and the first’s is the match’s. The specific’s is the first’s, and the first’s is the common’s. The two are the pair, and the pair is the order’s.

The ACCEPT‘s action. The ACCEPT is the pass’s, and the pass’s is the packet’s. The packet is the accepted, and the accepted is the continue’s. The two are the pair, and the pair is the action’s.

The DROP‘s action. The DROP is the silent’s, and the silent’s is the discard’s. The packet is the discarded, and the discarded is the no-response’s. The two are the pair, and the pair is the action’s.

Why the DROP matters. The DROP is the silent’s, and the silent’s is the scanner’s. The scanner’s is the timeout’s, and the timeout’s is the slow’s. The two are the pair, and the pair is the security’s.

The REJECT‘s action. The REJECT is the notified’s, and the notified’s is the response’s. The packet is the rejected, and the rejected is the ICMP’s. The two are the pair, and the pair is the action’s.

Why the REJECT matters. The REJECT is the notified’s, and the notified’s is the fast’s. The fast’s is the diagnostic’s, and the diagnostic’s is the friendly’s. The two are the pair, and the pair is the choice’s.

The JUMP‘s action. The JUMP is the chain’s, and the chain’s is the custom’s. The packet is the jumped, and the jumped is the other’s chain’s. The two are the pair, and the pair is the action’s.

Why the JUMP matters. The JUMP is the custom’s, and the custom’s is the organization’s. The custom’s chain is the group’s, and the group’s is the readable’s. The two are the pair, and the pair is the design’s.

The RETURN‘s action. The RETURN is the back’s, and the back’s is the caller’s. The packet is the returned, and the returned is the caller’s chain’s. The two are the pair, and the pair is the action’s.

Why the RETURN matters. The RETURN is the back’s, and the back’s is the custom’s. The custom’s chain is the return’s, and the return’s is the caller’s. The two are the pair, and the pair is the pattern’s.

Why the chains matter. The chains are the rule’s lists, and the lists are the order’s. The INPUT, the FORWARD, the OUTPUT are the filter’s, and the filter’s is the common’s. The two are the pair, and the pair is the model’s.

The connection’s tracking

The connection’s tracking is the conntrack, and the conntrack is the state’s. The conntrack tracks the connections, and the state’s rules use the tracked’s states.

The four states. The NEW, the ESTABLISHED, the RELATED, the INVALID. The four are the common, and the common is the state’s.

The NEW‘s state. The NEW is the first’s packet, and the first’s is the connection’s. The SYN’s is the NEW‘s, and the NEW‘s is the start’s. The two are the pair, and the pair is the state’s.

The ESTABLISHED‘s state. The ESTABLISHED is the connection’s, and the connection’s is the both’s. The both’s is the established’s, and the established’s is the data’s. The two are the pair, and the pair is the state’s.

The RELATED‘s state. The RELATED is the related’s, and the related’s is the new’s. The FTP’s data’s is the RELATED‘s, and the RELATED‘s is the separate’s. The two are the pair, and the pair is the state’s.

The INVALID‘s state. The INVALID is the invalid’s, and the invalid’s is the unknown’s. The unknown’s is the drop’s, and the drop’s is the security’s. The two are the pair, and the pair is the state’s.

Why the state’s rules matter. The state’s rules are the stateful’s, and the stateful’s is the simple’s. The ESTABLISHED‘s and the RELATED‘s are the accepted’s, and the accepted’s is the state’s. The two are the pair, and the pair is the stateful’s.

The stateful’s example. The iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT is the stateful’s, and the stateful’s is the accepted’s.

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

The two are the stateful’s, and the stateful’s is the common’s. The ESTABLISHED,RELATED is the accepted’s, and the INVALID is the dropped’s. The two are the pair, and the pair is the stateful’s.

Why the stateful’s rules matter. The stateful’s rules are the simple’s, and the simple’s is the readable’s. The NEW‘s is the specific’s, and the specific’s is the port’s. The two are the pair, and the pair is the design’s.

Why the conntrack matters. The conntrack is the state’s, and the state’s is the performance’s. The conntrack‘s table is the memory’s, and the memory’s is the limit’s. The two are the pair, and the pair is the tuning’s.

The default policy

The default policy is the chain’s fallback, and the fallback is the no-match’s. The packet that matches no rule is the policy’s, and the policy’s is the default’s.

The policy’s values. The ACCEPT, the DROP, the REJECT. The three are the common, and the common is the policy’s.

Why the default’s policy matters. The default’s policy is the security’s, and the security’s is the baseline’s. The DROP‘s policy is the secure’s, and the secure’s is the recommended’s. The two are the pair, and the pair is the design’s.

Why the ACCEPT‘s policy is the risky. The ACCEPT‘s policy is the permissive’s, and the permissive’s is the risky’s. The every’s is the accepted’s, and the accepted’s is the exposure’s. The two are the pair, and the pair is the risk’s.

Why the DROP‘s policy is the secure. The DROP‘s policy is the restrictive’s, and the restrictive’s is the secure’s. The specified’s is the accepted’s, and the accepted’s is the design’s. The two are the pair, and the pair is the secure’s.

The policy’s example. The iptables -P INPUT DROP is the policy’s, and the policy’s is the default’s.

sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

The three are the policy’s, and the policy’s is the default’s. The INPUT‘s and the FORWARD‘s are the dropped’s, and the OUTPUT‘s is the accepted’s. The two are the pair, and the pair is the baseline’s.

Why the OUTPUT‘s policy is the ACCEPT. The OUTPUT‘s policy is the accepted’s, and the accepted’s is the outgoing’s. The outgoing’s is the common’s, and the common’s is the convenient’s. The two are the pair, and the pair is the design’s.

Why the policy should be the documented. The policy should be the documented, and the documented is the audit’s. The policy’s is the review’s, and the review’s is the compliance’s. The two are the pair, and the pair is the discipline’s.

Why the policy should be the tested. The policy should be the tested, and the tested is the safety’s. The lockout’s is the risk’s, and the risk’s is the test’s. The two are the pair, and the pair is the discipline’s.

The tools

The tools are the iptables and the nftables, and the two are the front’s. The iptables is the legacy, and the nftables is the modern.

The iptables. The iptables is the legacy, and the legacy is the table’s and the chain’s. The iptables -L is the list’s, and the list’s is the rules’s.

sudo iptables -L -n -v
# Chain INPUT (policy DROP 0 packets, 0 bytes)
#  pkts bytes target     prot opt in     out     source               destination
#  1234 56789 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
#     0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED,RELATED

The sudo iptables -L -n -v is the list’s, and the list’s is the rules’s. The Chain INPUT is the chain’s, and the policy DROP is the policy’s. The two are the pair, and the pair is the legacy’s.

Why the iptables matters. The iptables is the legacy, and the legacy is the older’s. The older’s is the documentation’s, and the documentation’s is the reference’s. The two are the pair, and the pair is the migration’s.

The nftables. The nftables is the modern, and the modern is the table’s and the chain’s. The nft list ruleset is the list’s, and the list’s is the rules’s.

sudo nft list ruleset
# table inet filter {
#   chain input {
#     type filter hook input priority filter; policy drop;
#     tcp dport 22 accept
#     ct state established,related accept
#   }
# }

The sudo nft list ruleset is the list’s, and the list’s is the rules’s. The table inet filter is the table’s, and the chain input is the chain’s. The two are the pair, and the pair is the modern’s.

Why the nftables matters. The nftables is the modern, and the modern is the cleaner’s. The cleaner’s is the readable’s, and the readable’s is the maintainable’s. The two are the pair, and the pair is the modern’s.

Why the two are the same’s. The two are the same’s, and the same’s is the kernel’s. The kernel’s is the netfilter’s, and the netfilter’s is the framework’s. The two are the pair, and the pair is the implementation’s.

Why the migration matters. The migration is the iptables‘s to the nftables‘s, and the nftables‘s is the modern’s. The iptables-nft is the compatibility’s, and the compatibility’s is the transition’s. The two are the pair, and the pair is the migration’s.

Why the tools’s choice matters. The tools’s choice is the distribution’s, and the distribution’s is the default’s. The Debian’s, the Ubuntu’s, the Fedora’s are the modern’s, and the modern’s is the nftables‘s. The two are the pair, and the pair is the choice’s.

Complete Example Session

# ============================================
# PART 1: THE IPTABLES'S LIST
# ============================================

sudo iptables -L -n -v
# Chain INPUT (policy DROP 0 packets, 0 bytes)
#  pkts bytes target     prot opt in     out     source               destination
#  1234 56789 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
#     0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED,RELATED

# ============================================
# PART 2: THE NFTABLES'S LIST
# ============================================

sudo nft list ruleset
# table inet filter {
#   chain input {
#     type filter hook input priority filter; policy drop;
#     tcp dport 22 accept
#     ct state established,related accept
#   }
# }

# ============================================
# PART 3: THE HOOKS
# ============================================

# The incoming's packet:
#   The NIC ──► the PREROUTING ──► the routing's decision
#     ├── The local's ──► the INPUT ──► the local's process
#     └── The transit's ──► the FORWARD ──► the POSTROUTING ──► the NIC

# The outgoing's packet:
#   The local's process ──► the OUTPUT ──► the routing's decision
#     └── the POSTROUTING ──► the NIC

# ============================================
# PART 4: THE TABLES
# ============================================

# The filter: the INPUT, the FORWARD, the OUTPUT
# The nat:    the PREROUTING, the OUTPUT, the POSTROUTING
# The mangle: the PREROUTING, the INPUT, the FORWARD, the OUTPUT, the POSTROUTING
# The raw:    the PREROUTING, the OUTPUT
# The security: the INPUT, the FORWARD, the OUTPUT

# ============================================
# PART 5: THE STATES
# ============================================

# The NEW         → the first's packet
# The ESTABLISHED → the connection's
# The RELATED     → the related's
# The INVALID     → the invalid's

# ============================================
# PART 6: THE POLICY
# ============================================

sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# ============================================
# PART 7: THE STATEFUL'S RULES
# ============================================

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# ============================================
# PART 8: THE NFTABLES'S EQUIVALENT
# ============================================

sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input ct state invalid drop
sudo nft add rule inet filter input tcp dport 22 accept

# ============================================
# PART 9: THE DIAGNOSIS
# ============================================

# 1. The iptables -L -n -v  → the rules's
# 2. The nft list ruleset    → the nftables's
# 3. The ss -tlnp            → the listening's
# 4. The policy's check      → the default's

# ============================================
# PART 10: WHAT NOT TO DO
# ============================================

# Don't set the policy to the DROP without the SSH's rule
# The lockout's risk.                                        // ⚠️

# Don't forget the ESTABLISHED's rule
# The connection's break.                                    // ⚠️

# Don't use the ACCEPT's policy for the INPUT
# The permissive's risk.                                     // ⚠️

# Don't mix the iptables and the nftables
# The two's confusion.                                       // ⚠️

# Don't forget the conntrack's table
# The memory's limit.                                        // ⚠️

# Don't skip the test
# The lockout's risk.                                        // ⚠️

The ten parts cover the iptables’s list, the nftables’s list, the hooks, the tables, the states, the policy, the stateful’s rules, the nftables’s equivalent, the diagnosis, and the anti-patterns.

Quick Reference

The Five Hooks

The hook	The purpose
The `PREROUTING`	The incoming’s, before the routing
The `INPUT`	The local’s
The `FORWARD`	The transit’s
The `OUTPUT`	The local’s, outgoing
The `POSTROUTING`	The outgoing’s, after the routing

The Five Tables

The table	The purpose
The `filter`	The filtering (the default)
The `nat`	The address translation
The `mangle`	The packet’s alteration
The `raw`	The conntrack’s exception
The `security`	The SELinux’s

The Chains

The table	The chains
The `filter`	The `INPUT`, the `FORWARD`, the `OUTPUT`
The `nat`	The `PREROUTING`, the `OUTPUT`, the `POSTROUTING`
The `mangle`	The all five

The Actions

The action	The purpose
The `ACCEPT`	The pass
The `DROP`	The silent’s discard
The `REJECT`	The notified’s discard
The `JUMP`	The custom’s chain
The `RETURN`	The caller’s chain

The Conntrack’s States

The state	The meaning
The `NEW`	The first’s packet
The `ESTABLISHED`	The established’s
The `RELATED`	The related’s
The `INVALID`	The invalid’s

The Policies

The policy	The purpose
The `ACCEPT`	The permissive’s
The `DROP`	The secure’s
The `REJECT`	The notified’s

The Tools

The legacy	The modern
The `iptables`	The `nftables`
The `iptables -L`	The `nft list ruleset`
The `iptables-save`	The `nft list ruleset`

Best Practices

✅ Do This:

# Set the default's policy to the DROP
sudo iptables -P INPUT DROP                                    # ✅

# Add the SSH's rule before the policy
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT             # ✅

# Use the stateful's rules
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # ✅

# Drop the invalid's
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP  # ✅

# Use the nftables on the modern
sudo nft list ruleset                                          # ✅

# Test the rules before the persistence
# The lockout's risk.                                        # ✅

# Document the rules
# The policy's review.                                       # ✅

❌ Don’t Do This:

# Don't set the DROP's policy without the SSH's rule
sudo iptables -P INPUT DROP  # the lockout's risk              // ⚠️

# Don't forget the ESTABLISHED's rule
# The connection's break.                                    // ⚠️

# Don't use the ACCEPT's policy for the INPUT
sudo iptables -P INPUT ACCEPT  # the permissive's risk         // ⚠️

# Don't mix the iptables and the nftables
# The two's confusion.                                       // ⚠️

# Don't forget the conntrack's table
# The memory's limit.                                        // ⚠️

# Don't skip the test
# The lockout's risk.                                        // ⚠️

Common Pitfalls

Pitfall	Problem	Solution
The `DROP`‘s policy	The lockout	The SSH’s rule first
The missing `ESTABLISHED`	The connection’s break	The stateful’s rule
The `ACCEPT`‘s policy	The permissive	The `DROP`
The mixed tools	The confusion	The one tool
The `conntrack`‘s table	The memory	The tuning
The no test	The lockout	The test
The wrong chain	The no effect	The correct chain
The missing persistence	The reboot’s loss	The `iptables-save`

Real-World Examples

1. The list’s rules

sudo iptables -L -n -v

2. The nftables’s list

sudo nft list ruleset

3. The policy

sudo iptables -P INPUT DROP

4. The SSH’s rule

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

5. The stateful’s rule

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

6. The invalid’s drop

sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

7. The nftables’s table

sudo nft add table inet filter

8. The nftables’s chain

sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'

9. The nftables’s rule

sudo nft add rule inet filter input tcp dport 22 accept

10. The diagnosis

sudo iptables -L -n -v

Visual: The Packet’s Path

┌──────────────────────────────────────────────────────────┐
│  THE INCOMING'S PACKET                                   │
│    The NIC ──► the PREROUTING ──► the routing's decision │
│      │                                                   │
│      ├── The local's ──► the INPUT ──► the local's process│
│      │                                                   │
│      └── The transit's ──► the FORWARD ──► the POSTROUTING ──► the NIC│
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE OUTGOING'S PACKET                                   │
│    The local's process ──► the OUTPUT ──► the routing's decision│
│      │                                                   │
│      └── the POSTROUTING ──► the NIC                     │
│                                                          │
│  The hooks are the packet's path, and the path is the    │
│  rule's.                                                 │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Tables and the Chains

┌──────────────────────────────────────────────────────────┐
│  THE FILTER'S TABLE                                      │
│    The INPUT   → the local's incoming                    │
│    The FORWARD → the transit's                           │
│    The OUTPUT  → the local's outgoing                    │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE NAT'S TABLE                                         │
│    The PREROUTING  → the DNAT                            │
│    The OUTPUT      → the local's NAT                     │
│    The POSTROUTING → the SNAT, the MASQUERADE            │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE MANGLE'S TABLE                                      │
│    The all five → the TTL, the QoS                       │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE RAW'S TABLE                                         │
│    The PREROUTING, the OUTPUT → the NOTRACK              │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Conntrack’s States

┌──────────────────────────────────────────────────────────┐
│  THE NEW                                                 │
│    The first's packet (the SYN).                         │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE ESTABLISHED                                         │
│    The established's connection.                         │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE RELATED                                             │
│    The related's connection (the FTP's data).            │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE INVALID                                             │
│    The invalid's packet (the unknown).                   │
│                                                          │
│  The stateful's rules are the simple, and the simple     │
│  is the readable.                                        │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The Policy

┌──────────────────────────────────────────────────────────┐
│  THE DEFAULT'S POLICY                                    │
│    The no-match's packet.                                │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE ACCEPT                                              │
│    The permissive's.                                     │
│    The every's is the accepted.                          │
│    The risk's.                                           │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE DROP                                                │
│    The secure's.                                         │
│    The specified's is the accepted.                      │
│    The recommended's.                                    │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE REJECT                                              │
│    The notified's.                                       │
│    The ICMP's response.                                  │
│    The friendly's.                                       │
│                                                          │
└──────────────────────────────────────────────────────────┘

Visual: The iptables and the nftables

┌──────────────────────────────────────────────────────────┐
│  THE IPTABLES                                            │
│    sudo iptables -L -n -v                                │
│    Chain INPUT (policy DROP 0 packets, 0 bytes)          │
│     pkts bytes target prot opt in out source destination │
│                                                          │
├──────────────────────────────────────────────────────────┤
│  THE NFTABLES                                            │
│    sudo nft list ruleset                                 │
│    table inet filter {                                   │
│      chain input {                                       │
│        type filter hook input priority filter; policy drop;│
│        tcp dport 22 accept                               │
│      }                                                   │
│    }                                                     │
│                                                          │
│  The two are the same's, and the same's is the kernel's. │
│  The netfilter is the framework, and the two are the     │
│  front's.                                                │
│                                                          │
└──────────────────────────────────────────────────────────┘

Summary

Item	Value
The firewall	The packet’s filter
The netfilter	The kernel’s framework
The hooks	The `PREROUTING`, the `INPUT`, the `FORWARD`, the `OUTPUT`, the `POSTROUTING`
The tables	The `filter`, the `nat`, the `mangle`, the `raw`, the `security`
The filter’s chains	The `INPUT`, the `FORWARD`, the `OUTPUT`
The actions	The `ACCEPT`, the `DROP`, the `REJECT`, the `JUMP`, the `RETURN`
The states	The `NEW`, the `ESTABLISHED`, the `RELATED`, the `INVALID`
The policy	The `ACCEPT`, the `DROP`, the `REJECT`
The legacy	The `iptables`
The modern	The `nftables`

Key takeaways:

A firewall is the packet’s filter — it inspects the packets at the kernel’s hooks and applies the rules from the tables and the chains
The netfilter is the kernel’s framework, and the hooks are its points — the PREROUTING, the INPUT, the FORWARD, the OUTPUT, the POSTROUTING
The filter table is the default, and the INPUT, the FORWARD, the OUTPUT are its chains — the INPUT is the server’s, and the FORWARD is the router’s
The nat table is the address translation’s — the DNAT is the port forward’s, and the SNAT and the MASQUERADE are the outgoing’s
The actions are the ACCEPT, the DROP, the REJECT, the JUMP, the RETURN — the DROP is the silent’s, and the REJECT is the notified’s
The conntrack’s states are the NEW, the ESTABLISHED, the RELATED, the INVALID — the stateful’s rules are the simple, and the simple is the readable
The default’s policy is the chain’s fallback — the DROP is the secure’s, and the ACCEPT is the permissive’s
The iptables is the legacy, and the nftables is the modern — the two use the same kernel’s netfilter, and the two are the front’s
The rules should be the minimal, the documented, and the tested — the lockout’s risk is the discipline’s
The firewall is the layer’s, not the only’s — the depth’s is the defense’s, and the firewall is one of the layers

Remember: The firewall is the packet’s filter, and the netfilter is the kernel’s framework. The hooks are the packet’s path, and the tables are the rule’s groups. The filter is the default, and the nat is the translation’s. The actions are the five, and the states are the four. The policy is the fallback, and the DROP is the secure’s. The iptables is the legacy, and the nftables is the modern. The firewall’s rules are the security’s, and the security’s is the discipline.

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!