Linux's Next-Generation Firewall
FAQ
Nftables promises to be the future of Linux firewalls. Meet iptables' replacement.
Q: Why should I be concerned about what Christian hip-hop artist Nate Feuerstein does with his tables?
A: Not NF's tables, but nftables (or Netfilter tables). It's the name of the next-generation firewall for Linux.
Q: Firewall? That sounds like a pretty horrible thing. Even if the fire doesn't spread, the smoke damage would be catastrophic for the interior decoration. I can't imagine it'd be too good for the computer either, especially as the fan that's supposed to keep the CPU cool would only make the fire hotter. You can keep your pyromania to yourself, thank you very much.
A: Just on the off chance that you're not being deliberately difficult, a firewall is a bit of software that looks at all the network traffic going in or out of your machine and decides if it should be let through or not. These can be as simple or complex as you like. For example, a really basic firewall would let any outbound connections through (so you could get data from other machines) but not any inbound connections (so no one could request data from you). If you then decided to run a web server on this machine, you'd have to open up port 80 so that browsers could connect to you.
Q: Hang on, I'd need 80 ports? I've only got one Ethernet connection. Where would I get the other 79?
A: In IP networking (which is almost all networking these days), you need two identifying things when connecting to the other computer. There's the IP address, which locates the machine to which you want to connect, and there's a port number, which identifies the software you want to connect to on that machine. The port number doesn't refer to a physical port but is just a reference, so the machine receiving the connection knows where to send the data.
On any machine, only one piece of software can be listening on a given port, so the kernel forwards all data to that software. All ports are the same, so in principle you could have any software listening on any port number, but a few conventions make life a little easier. For example, web servers usually listen on port 80 (for HTTP) and 443 (for HTTPS), so when you use a web browser, it will always try to use these ports unless you specify a different port, which is done by adding a colon and then the port number after the web server domain name.
Q: Ah, OK. So all I have to do is tell my firewall what services I want to run, and it'll open up those ports?
A: Well, that would be a very basic setup. Firewalls can do quite a lot more than this, though. The current standard Linux firewall, iptables, allows you to do things like limit access to certain services to particular machines (usually identified by IP address), log particular events, and even block people who are repeatedly trying to guess passwords. All together, the iptables firewall is a large part of most Linux setups' security.
Q: This all sounds quite useful. I should get a firewall.
A: If you're using Linux, you probably already have one, and it's probably iptables. You can see what it's currently doing by entering the following at the command line:
sudo iptables --list
This will give you a list of rules. For each packet, the firewall starts at the top, and each rule is a pattern to match that might contain a port, an IP address, or some other way of matching a packet. Each rule has either an accept, reject, or log action. If the packet matches that rule, the firewall performs the action; if it doesn't, it moves onto the next rule until it gets to the bottom. If nothing matches, the firewall accepts the packet. Nftables works in much the same way.
Q: OK. If iptables is so popular and nftables works in much the same way, why should I bother with nftables?
A: That's an excellent question. Iptables is a mature, well-understood technology that you shouldn't be in a rush to get rid of, but at the same time, it does have some weaknesses. For example, iptables only works with IPv4, which is still the most common version of the IP protocol, but IPv6 is slowly becoming more used. There is an IPv6 equivalent (rather unimaginatively called ip6tables), but this means that you have to duplicate all your work to make sure you stay secure on a machine that supports both versions (and you should support both versions if possible).
The second major difference is that the rule syntax allows more concise expression. In many cases, rules that would have taken many lines of iptables rules can be done in a single line with nftables. This might not seem like a huge deal if you're only using small rulesets, but it's not uncommon for server setups to have iptables configurations that span several hundred lines, and shortening this makes it much easier to maintain.
Beyond this, there are a few advantages for larger setups, such as faster updating of rules, but these are only really applicable to large data centers.
In short, there are no major problems with iptables, but nftables is a bit better and likely to be the future of firewalls on Linux.
Q: When can I get started with nftables?
A: Right now [1]. Well, depending on your distro, that is. Support for nftables first came into Linux with kernel version 3.13, which was back in January 2014, so most modern distros should have it available (although you might have to install a package from the repository to get it to work) [2]. If you're using a slow-moving enterprise distro, you might have to upgrade to get support. Take a look at your distro's documentation for more details.
Q: So, I guess this begs the question: Should I be using iptables or nftables?
A: There's no simple answer to that. If you're currently using iptables and it's working for you, then there's no pressing need to switch at the moment. On the other hand, if you're not using a firewall, or learning how to configure them for the first time, then you might want to consider nftables, because it's likely to be the future of Linux firewalls.
Infos
- Want to get up and running with nftables? The project website (http://www.netfilter.org) has more information than you could possibly want.
- Nftables has been part of the Linux Kernel since version 3.13, but it needs to be selected before compiling, so make sure to select the right options if you build your own.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
The GNU Project Celebrates Its 40th Birthday
September 27 marks the 40th anniversary of the GNU Project, and it was celebrated with a hacker meeting in Biel/Bienne, Switzerland.
-
Linux Kernel Reducing Long-Term Support
LTS support for the Linux kernel is about to undergo some serious changes that will have a considerable impact on the future.
-
Fedora 39 Beta Now Available for Testing
For fans and users of Fedora Linux, the first beta of release 39 is now available, which is a minor upgrade but does include GNOME 45.
-
Fedora Linux 40 to Drop X11 for KDE Plasma
When Fedora 40 arrives in 2024, there will be a few big changes coming, especially for the KDE Plasma option.
-
Real-Time Ubuntu Available in AWS Marketplace
Anyone looking for a Linux distribution for real-time processing could do a whole lot worse than Real-Time Ubuntu.
-
KSMBD Finally Reaches a Stable State
For those who've been looking forward to the first release of KSMBD, after two years it's no longer considered experimental.
-
Nitrux 3.0.0 Has Been Released
The latest version of Nitrux brings plenty of innovation and fresh apps to the table.
-
Linux From Scratch 12.0 Now Available
If you're looking to roll your own Linux distribution, the latest version of Linux From Scratch is now available with plenty of updates.
-
Linux Kernel 6.5 Has Been Released
The newest Linux kernel, version 6.5, now includes initial support for two very exciting features.
-
UbuntuDDE 23.04 Now Available
A new version of the UbuntuDDE remix has finally arrived with all the updates from the Deepin desktop and everything that comes with the Ubuntu 23.04 base.