RHEL 8 New Features for Experienced Linux Administrators

Log in to servera as the root user.

[student@workstation ~]$ ssh root@servera

Nftables basic usage and configuration.

1. List all tables currently active.

   [root@servera ~]# nft list tables
   table ip filter
   table ip6 filter
   ...output omitted...

2. List all currently active chains.

   [root@servera ~]# nft list chains
   table ip filter {
     chain INPUT {
       type filter hook input priority 0; policy accept;
     }
     chain FORWARD {
       type filter hook forward priority 0; policy accept;
     }
     chain OUTPUT {
       type filter hook output priority 0; policy accept;
     }
   }
   table ip6 filter {
     chain INPUT {
       type filter hook input priority 0; policy accept;
     }
     chain FORWARD {
       type filter hook forward priority 0; policy accept;
     }
     chain OUTPUT {
       type filter hook output priority 0; policy accept;
     }
   }
   ...output omitted...

3. Add a firewall rule allowing inbound HTTP.

   [root@servera ~]# nft insert rule ip filter INPUT tcp dport http accept

4. List all chains for the table ip filter in order to locate the handle for the rule just added.

   [root@servera ~]# nft list table ip filter -n -a
   table ip filter { # handle 1
     chain INPUT { # handle 1
       type filter hook input priority 0; policy accept;
       tcp dport http accept # handle 4
     }
   ...output omitted...
   

5. Remove the rule currently allowing HTTP access using the handle.

   [root@servera ~]# nft delete rule filter INPUT handle 4

6. Create a rule enabling access for multiple ports at the same time.

   [root@servera ~]# nft insert rule ip filter INPUT \
   > tcp dport { ssh, http, https, 8181 } accept

7. Set the INPUT chain default policy to drop all traffic not specifically accepted.

   [root@servera ~]# nft add chain ip filter INPUT \
   > { type filter hook input priority 0\; policy drop\; }

Remove rules added during this exercise.

1. Set the INPUT chain default policy to accept all traffic by default.

   [root@servera ~]# nft add chain ip filter INPUT \
   > { type filter hook input priority 0\; policy accept\; }

2. Find the handle and remove the rule currently allowing access for SSH, HTTP, HTTPS, and 8181.

   [root@servera ~]# nft list table ip filter -n -a
   table ip filter { # handle 1
     chain INPUT { # handle 1
       type filter hook input priority 0; policy accept;
       tcp dport { ssh, http, https, 8181 } accept # handle 6
     }
   ...output omitted...
   [root@servera ~]# nft delete rule filter INPUT handle 6

Log off from servera.

[root@servera ~]# exit
Connection to servera closed.