Hands-on guide series
Firewalls with nftables: A Hands-On Guide
A five-part, hands-on guide to building a firewall with nftables on a single VPS: the family, table and chain model that replaced iptables, a safe policy-drop base ruleset that keeps your SSH session alive, sets, maps and rate limiting, NAT with port forwarding and logging, and persistence with a dry-run and a dead-man revert. Every command tested on a live Ubuntu 24.04 server.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
The nftables Model: Families, Tables and ChainsLearn the nftables model on Ubuntu 24.04: families, tables, base chains with hooks and priorities, rule handles, and the atomic ruleset load.9 min - 2
A Safe Base Ruleset with Policy DropBuild a safe nftables base ruleset on Ubuntu 24.04: a policy-drop input chain in the correct order that keeps your live SSH session alive.8 min - 3
Sets, Maps and Rate LimitingUse nftables sets, maps and rate limiting on Ubuntu 24.04 to keep a ruleset short: a named allowlist, a verdict map, counters and a limit rate.7 min - 4
NAT, Port Forwarding and LoggingConfigure nftables NAT on Ubuntu 24.04: redirect a port to a local service, understand dnat and masquerade, and log a labelled drop to the kernel.7 min - 5
Persistence and Testing Without Lock-OutMaster nftables persistence on Ubuntu 24.04: the config file and service, the nft -c -f dry-run check, and a dead-man revert that prevents lock-out.7 min