Learn Void Linux - Firewall: nftables

#Introduction

With the web server standing in episode 12, your system is now exposed to the internet — and that's the right time to build a firewall. Episode 13 covers nftables, the modern firewall framework that replaces iptables, with Void's clear and direct approach.

nftables organizes rules in a cleaner structure: a table contains chains, and a chain contains rules. With concise syntax and file-based configuration support, nftables is far easier to read and manage than long iptables scripts.

Let's start with the basic concepts.

#nftables Fundamentals

#Table, Chain, and Rule

nftables works in three layers:

Table  -> Chain -> Rule
         (hook)   (match + verdict)

A table groups configuration, a chain determines the intervention point (input, forward, output), and a rule decides what happens to matching traffic. View the active configuration:

sudo nft list ruleset

The output of nft list ruleset shows the entire running firewall configuration.

#Writing a Basic Ruleset

#Creating Tables and Chains

Create the basic tables and chains:

sudo nft add table inet filter
sudo nft add chain inet filter input '{ type filter hook input priority 0; policy accept; }'
sudo nft add chain inet filter forward '{ type filter hook forward priority 0; policy accept; }'
sudo nft add chain inet filter output '{ type filter hook output priority 0; policy accept; }'

In nft add chain, the syntax { type filter hook input priority 0; policy accept; } defines the input chain with a default accept policy.

#Adding Rules

Add rules to open the ports you need — for example SSH and web:

sudo nft add rule inet filter input tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 80 accept
sudo nft add rule inet filter input tcp dport 443 accept

For a stricter policy, set the default policy to drop and add rules for established connections:

sudo nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iif lo accept

#A Persistent Ruleset

#Saving the Ruleset to a File

Rules added via the CLI are lost on reboot. Save them to a file and create a runit service to make them persistent:

sudo nft list ruleset | sudo tee /etc/nftables.conf
sudo ln -s /etc/sv/nftables /var/service/

The nft list ruleset | sudo tee /etc/nftables.conf command saves the active ruleset to a file that will be loaded at boot by the nftables service.

#Reloading the Ruleset

After editing the file, reload and verify:

sudo nft -f /etc/nftables.conf
sudo nft list ruleset

A good habit: always verify with nft list ruleset after every change so a bad rule doesn't silently cut off access.

#Routing and NAT

#Enabling IP Forwarding

To build a gateway, enable IP forwarding:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/ipforward.conf
sudo sysctl -p /etc/sysctl.d/ipforward.conf

The echo 'net.ipv4.ip_forward = 1' in /etc/sysctl.d/ipforward.conf makes the setting persist across reboots.

#Masquerade for NAT

To let clients on the local network reach the internet, add a postrouting chain with masquerade:

sudo nft add table ip nat
sudo nft add chain ip nat postrouting '{ type nat hook postrouting priority 100; }'
sudo nft add rule ip nat postrouting oifname "eth0" masquerade

The nft add rule ip nat postrouting oifname "eth0" masquerade command masquerades all outgoing traffic through eth0. Adjust the interface name to match your WAN.

#Verification and Troubleshooting

#Checking Matching Rules

To see how traffic is processed, add a counter to a rule and observe it:

sudo nft add rule inet filter input tcp dport 22 counter accept
sudo nft list ruleset | grep counter

The output of nft list ruleset | grep counter shows the number of packets matching each rule. These counters are very helpful for confirming the firewall works as expected.

#Common Mistakes

The two most frequent errors: forgetting the established,related rule so established connections get dropped, and failing to save the ruleset so the rules disappear after reboot. Keep these two things in mind when writing your first firewall.

#Conclusion

Episode 13 equipped you with nftables firewall skills on Void: understanding the table, chain, and rule structure, writing rulesets with the nft CLI, creating a persistent configuration, and enabling IP forwarding and NAT masquerade to build a gateway.

Key takeaways:

• nftables organizes rules into tables, chains, and rules.
• nft list ruleset shows the entire active configuration.
• Save the ruleset to /etc/nftables.conf to make it persistent.
• Always include the established,related rule with a drop policy.
• IP forwarding is enabled via sysctl.
• NAT masquerade lets local clients reach the internet.

In the next episode, episode 14, we will cover security and hardening — hardening SSH, enforcing sudo policy, maintaining the firewall, running audits with lynis and fail2ban, and making regular upgrades with xbps-install -Su a habit.