Learning Devuan GNU/Linux - Firewall: nftables & iptables

#Introduction

A server without a firewall is an unlocked door. Episode 13 covers firewalls on Devuan: building rulesets with nftables and iptables, understanding the differences between them, using UFW for convenience, and configuring IP forwarding, NAT, and a gateway for machines acting as routers.

On Devuan, a firewall runs like any other service — managed by init. The only difference is how the ruleset is stored and loaded. After this episode, you'll be able to build firewall rules that survive a reboot and explain each line.

#nftables: The Modern Firewall

#Building a Basic Ruleset

nftables is iptables' successor, unifying all tables in a single tool. Rulesets are written in cleaner syntax. A basic ruleset example for a server:

sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iif lo accept
sudo nft add rule inet filter input tcp dport 22 accept

The first line creates the inet filter table, the second creates the input chain with a drop policy, and the following lines accept established connections, loopback traffic, and SSH. Display the entire ruleset:

sudo nft list ruleset

sudo nft list ruleset shows all active tables, chains, and rules — a complete picture of your firewall policy.

#Saving the Ruleset for Persistence

nftables rulesets don't survive a reboot automatically. Save and restore:

sudo nft list ruleset | sudo tee /etc/nftables.conf
sudo service nftables restart

The /etc/nftables.conf file is read by the nftables service at boot. If you change the ruleset, update this file and restart the service to stay consistent.

#iptables: The Legacy That's Still Used

#Traditional Syntax

iptables is the classic firewall tool, still widely used and fully supported on Devuan. Commands equivalent to the nftables example above:

sudo iptables -P INPUT DROP
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -P INPUT DROP sets the default policy of the INPUT chain to drop. The -A command adds rules in order — this order determines the firewall's behavior.

#Save and Restore with iptables-persistent

To persist an iptables ruleset, use the iptables-persistent package:

sudo apt install iptables-persistent
sudo netfilter-persistent save
sudo netfilter-persistent reload

netfilter-persistent save stores the active ruleset to /etc/iptables/rules.v4, which the service loads at boot. Pick one tool — nftables or iptables — and don't mix them on the same machine.

#UFW: The Easy Firewall

#Enabling UFW

UFW (Uncomplicated Firewall) is an iptables wrapper providing simple syntax. It's ideal for beginners or servers that want quick configuration:

sudo apt install ufw
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw enable
sudo ufw status verbose

sudo ufw enable turns on the firewall and makes it active at boot. The command ufw status verbose shows active rules. Always allow SSH before enabling UFW so you don't lock yourself out of the server.

#Routing: Forwarding and NAT

#Enabling IP Forwarding

To make Devuan a gateway, enable packet forwarding between interfaces:

sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.d/99-forward.conf

sudo sysctl -w net.ipv4.ip_forward=1 enables forwarding immediately; the second line makes it permanent via sysctl. Without forwarding, packets won't be passed between networks.

#NAT with nftables

For a machine acting as an internet gateway, add a masquerade rule:

sudo nft add table ip nat
sudo nft add chain ip nat postrouting '{ type nat hook postrouting priority 100; }'
sudo nft add rule ip nat postrouting oif eth0 masquerade

The rules above apply NAT masquerade to all packets leaving through eth0 — rewriting the source IP to the gateway IP. This is the basic pattern for a home router or edge server.

#Conclusion

Episode 13 covered firewalls on Devuan: building rulesets with nftables and iptables, understanding their syntax differences, using UFW for convenience, and configuring IP forwarding and NAT for gateway machines.

Key takeaways:

• nftables is iptables' successor with cleaner syntax.
• Save the ruleset to a file so it survives a reboot.
• Don't mix nftables and iptables on one machine.
• UFW is an easy-to-use iptables wrapper.
• IP forwarding is enabled via sysctl.
• Masquerade in the postrouting chain provides NAT for a gateway.

In the next episode, episode 14, we'll cover security and hardening — tightening SSH, setting sudo policy, running audits with lynis, preventing brute-force with fail2ban, and automating security updates with unattended-upgrades.