Firewall (nftables)

Author and reason about nftables rulesets — filtering, NAT and policy.

45 challenges · 12 easy · 18 medium · 15 pro

• Accept Related ICMP Errorseasy · in-browser
  Write /etc/nftables.conf with a table inet filter and an input chain (type filter hook input, policy drop). Add one rule that accepts conntrack packets in the established or related states so that ICMP errors and reply traffic for connections you initiated are allowed back in. (Authored config, graded structurally — the engine isn't run here.)
• Always trust loopbackeasy
  Author /etc/nftables.conf with the base (table inet filter, input chain: type filter hook input, policy drop) plus a rule that accepts ALL traffic arriving on the loopback interface.
• Author a base nftables ruleseteasy
  There is no firewall engine here — write a correct nftables ruleset to /etc/nftables.conf: a table 'inet filter', an 'input' chain (type filter hook input) with policy drop, and a rule that accepts tcp dport 22.
• Define a Variable for WAN Interfaceeasy · in-browser
  Write /etc/nftables.conf that defines a variable named wan set to the interface name "eth0" using nftables `define`, then uses that variable in an input chain rule of the form `iifname $wan ...`. The table must be inet filter with an input chain (type filter hook input). (Authored config, graded structurally — the engine isn't run here.)
• Drop Invalid Conntrack Earlyeasy · in-browser
  Write /etc/nftables.conf with a table inet filter and an input chain (type filter hook input). As the first matching behaviour, drop any packet whose conntrack state is invalid (ct state invalid drop) so malformed or out-of-window packets never reach later rules. (Authored config, graded structurally — the engine isn't run here.)
• Idempotent ruleset headereasy · in-browser
  Write /etc/nftables.conf starting with `flush ruleset` then a table inet filter with an input chain (hook input, policy drop). (Authored config, graded structurally — the engine isn't run here.)
• Include a Drop-In Ruleset Fileeasy · in-browser
  Write /etc/nftables.conf that starts by flushing the ruleset, declares a table inet filter, and pulls in an external file with an nftables `include` statement pointing at "/etc/nftables.d/*.nft". The first line must be the flush. (Authored config, graded structurally — the engine isn't run here.)
• Named hook priorityeasy · in-browser
  Author /etc/nftables.conf where the input chain uses the named priority `filter` (type filter hook input priority filter;). (Authored config, graded structurally — the engine isn't run here.)
• Output chain accepteasy · in-browser
  Author /etc/nftables.conf with a base table inet filter and an output chain (type filter hook output) policy accept. (Authored config, graded structurally — the engine isn't run here.)
• Restrict SSH to a CIDReasy · in-browser
  Write /etc/nftables.conf (base table inet filter, input hook, policy drop) accepting tcp dport 22 ONLY from 10.0.0.0/8. (Authored config, graded structurally — the engine isn't run here.)
• Set base-chain policieseasy
  Author /etc/nftables.conf with a table inet filter and the three base chains: input and forward with policy drop, output with policy accept (all `type filter hook ...`).
• Trust several interfaceseasy · in-browser
  Author /etc/nftables.conf accepting input on iifname { "lo", "eth0" } (base table inet filter / input / policy drop). (Authored config, graded structurally — the engine isn't run here.)
• Accept a port rangemedium · in-browser
  Author /etc/nftables.conf accepting tcp dport 30000-30010 (base inet filter / input / policy drop). (Authored config, graded structurally — the engine isn't run here.)
• Allow ping under a drop policymedium
  Extend the nftables ruleset so it also accepts ICMP echo-request (ping). Keep the base (table inet filter, input hook, policy drop).
• Block IPs with a named setmedium
  Extend /etc/nftables.conf: define a named set 'blocklist' of ipv4 addresses and an input rule that drops packets whose source is in @blocklist. Keep a base table inet filter / input chain.
• DNAT With a Port-to-Host Mapmedium · in-browser
  Write /etc/nftables.conf with a table ip nat and a prerouting chain (type nat hook prerouting priority dstnat). Declare a named map called `web` of type `inet_service : ipv4_addr` whose elements map port 80 to 10.0.0.10 and port 443 to 10.0.0.20, then DNAT inbound tcp with `dnat to tcp dport map @web`. (Authored config, graded structurally — the engine isn't run here.)
• Dispatch With goto to a Regular Chainmedium · in-browser
  Write /etc/nftables.conf with a table inet filter. Define a regular chain named `web_in` (no type/hook) that accepts the traffic with an `accept` verdict. From the input chain (type filter hook input), send tcp dport 80 traffic to it with `goto web_in`. (Authored config, graded structurally — the engine isn't run here.)
• Hardware/Software Flow Offloadmedium · in-browser
  Write /etc/nftables.conf with a table inet filter that declares a flowtable named `ft` with `hook ingress priority 0` and `devices = { eth0, eth1 }`. In the forward chain (type filter hook forward) offload established tcp/udp flows with a rule using `flow add @ft` for `ct state established`. (Authored config, graded structurally — the engine isn't run here.)
• IPv6 ICMPv6 acceptmedium · in-browser
  Author /etc/nftables.conf accepting icmpv6 (ipv6 neighbour discovery): a rule with `meta nfproto ipv6 icmpv6 type` ... accept or `ip6 nexthdr icmpv6 accept`. (Authored config, graded structurally — the engine isn't run here.)
• Jump to a regular chainmedium · in-browser
  Author /etc/nftables.conf with a regular (non-base) chain `web` and the input chain `jump web` for tcp dport 80. (Authored config, graded structurally — the engine isn't run here.)
• Log + count dropsmedium · in-browser
  Write /etc/nftables.conf whose input chain (policy drop) has a trailing rule with a counter and `log prefix "drop "` before the implicit drop. (Authored config, graded structurally — the engine isn't run here.)
• Log Then Drop UDP By Meta L4protomedium · in-browser
  Write /etc/nftables.conf with a table inet filter and an input chain (type filter hook input, policy drop). For udp traffic, match with `meta l4proto udp`, log it with the prefix "udp-drop " at log level info, then drop it — all on the same rule. (Authored config, graded structurally — the engine isn't run here.)
• Named countermedium · in-browser
  Author /etc/nftables.conf declaring a named counter `http` and a rule using `counter name http`. (Authored config, graded structurally — the engine isn't run here.)
• Offload SYN Floods to synproxymedium · in-browser
  Write /etc/nftables.conf with a table inet filter and a prerouting chain (type filter hook prerouting). For new tcp connections to dport 80 (match ct state new), apply tcp synproxy with `synproxy mss 1460 wscale 7`. An input chain (type filter hook input) should also exist. (Authored config, graded structurally — the engine isn't run here.)
• Open web ports + keep statemedium
  Extend /etc/nftables.conf (keep the base: inet filter, input hook, policy drop, accept tcp 22) so it also accepts established/related connections and tcp dport { 80, 443 }.
• Rate limit with burstmedium · in-browser
  Author /etc/nftables.conf rate-limiting new tcp dport 80 with `limit rate 10/second burst 20 packets`. (Authored config, graded structurally — the engine isn't run here.)
• Reject instead of dropmedium · in-browser
  Write /etc/nftables.conf where tcp dport 8080 is explicitly rejected with a TCP reset (reject with tcp reset), base table inet filter / input / policy drop. (Authored config, graded structurally — the engine isn't run here.)
• Set and match a packet markmedium · in-browser
  Author /etc/nftables.conf that `meta mark set 0x1` for tcp dport 22 and elsewhere matches `meta mark 0x1`. (Authored config, graded structurally — the engine isn't run here.)
• Stateful established-onlymedium · in-browser
  Write /etc/nftables.conf input chain (policy drop) that accepts ct state established,related and drops ct state invalid. (Authored config, graded structurally — the engine isn't run here.)
• Trust a CIDR Range With an Interval Setmedium · in-browser
  Write /etc/nftables.conf with a table inet filter that declares a named set `trusted` of type ipv4_addr with `flags interval`, containing the element 10.8.0.0/24. In the input chain (type filter hook input, policy drop) accept any packet whose `ip saddr @trusted`. (Authored config, graded structurally — the engine isn't run here.)
• Anti-spoof with fibpro · in-browser
  Author /etc/nftables.conf with an fib reverse-path check: `fib saddr . iif oif missing drop` in the input chain. (Authored config, graded structurally — the engine isn't run here.)
• DNAT a portpro · in-browser
  Author /etc/nftables.conf with a nat table, prerouting chain (type nat hook prerouting), `tcp dport 443 dnat to 10.0.0.5:8443`. (Authored config, graded structurally — the engine isn't run here.)
• Dispatch with a verdict mappro · in-browser
  Write /etc/nftables.conf using a verdict map on tcp dport to accept 22 and 443 (e.g. `tcp dport vmap { 22 : accept, 443 : accept }`), base table inet filter / input / policy drop. (Authored config, graded structurally — the engine isn't run here.)
• Drop bogus TCP flagspro · in-browser
  Author /etc/nftables.conf dropping invalid flag combos: a rule `tcp flags & (fin|syn) == (fin|syn) drop` and ct state invalid drop. (Authored config, graded structurally — the engine isn't run here.)
• Dynamic timed blocklistpro · in-browser
  Author /etc/nftables.conf with a set `blocked` that has `flags dynamic` and a `timeout`, and a rule adding offenders with `add @blocked`. (Authored config, graded structurally — the engine isn't run here.)
• Match OS by Passive Fingerprintpro · in-browser
  Write /etc/nftables.conf with a table inet filter and an input chain (type filter hook input, policy drop). Use the passive OS fingerprinting expression to drop packets that look like Windows: match `tcp dport 22` and `osf name "Windows"`, log with prefix "win-ssh ", and drop. (Authored config, graded structurally — the engine isn't run here.)
• NAT masquerade egresspro · in-browser
  Write /etc/nftables.conf with a nat table, a postrouting chain (type nat hook postrouting) that masquerades traffic leaving oifname "eth0". (Authored config, graded structurally — the engine isn't run here.)
• Named quotapro · in-browser
  Author /etc/nftables.conf declaring a named quota `dl` (over 1 gbytes) and a rule using `quota name dl`. (Authored config, graded structurally — the engine isn't run here.)
• Per-Source Rate Limit With a Meterpro · in-browser
  Write /etc/nftables.conf with a table inet filter and an input chain (type filter hook input, policy drop). Rate-limit new SSH connections per source address: match `tcp dport 22 ct state new`, then use a dynamic meter keyed by ip saddr — `meter sshflood { ip saddr limit rate over 4/minute }` — and drop packets that exceed the limit. (Authored config, graded structurally — the engine isn't run here.)
• Rate-limit new SSH + drop invalidpro
  Harden /etc/nftables.conf: drop ct state invalid, and for NEW ssh connections (tcp dport 22, ct state new) apply a `limit rate` and log the excess. Keep the base table/chain/policy.
• Redirect a port with NATpro
  Author /etc/nftables.conf with a NAT table whose prerouting chain (type nat hook prerouting) redirects inbound tcp dport 8080 to port 80.
• Register an FTP Conntrack Helperpro · in-browser
  Write /etc/nftables.conf with a table ip filter that declares a `ct helper` object named `ftp-helper` of `type "ftp"` with `protocol tcp`. In the input chain (type filter hook input) assign the helper to control-channel traffic with a rule `tcp dport 21 ct helper set "ftp-helper"`. (Authored config, graded structurally — the engine isn't run here.)
• Round-Robin Load Balance With numgenpro · in-browser
  Write /etc/nftables.conf with a table ip nat and a prerouting chain (type nat hook prerouting). Load-balance inbound tcp dport 443 across two backends by using `numgen inc mod 2` as a map key: `dnat to numgen inc mod 2 map { 0 : 10.0.0.11, 1 : 10.0.0.12 }`. (Authored config, graded structurally — the engine isn't run here.)
• SNAT egresspro · in-browser
  Author /etc/nftables.conf nat postrouting (type nat hook postrouting) `oifname "eth0" snat to 203.0.113.7`. (Authored config, graded structurally — the engine isn't run here.)
• Transparent Proxy Diversionpro · in-browser
  Write /etc/nftables.conf with a table ip mangle and a prerouting chain (type filter hook prerouting priority mangle). Divert outbound web traffic to a local proxy: for `tcp dport 80`, redirect it with `tproxy to :3129` and set a packet mark of 1 with `meta mark set 1`. (Authored config, graded structurally — the engine isn't run here.)