firewall-patterns

Firewall Patterns

iptables/nftables rulesets, cloud security group patterns, and firewall design principles.

Knowledge Base

Firewall Processing Models

Different firewalls process rules differently. Understanding the model is critical for correct configuration:

Firewall	Processing	Implication
iptables	Sequential (first match wins)	Rule order matters. A broad ACCEPT before a specific DROP makes the DROP unreachable.
nftables	Sequential within chains, but supports sets and maps for efficiency	More flexible than iptables, same sequential logic.
AWS Security Groups	All rules evaluated, any allow = allow. No deny rules.	Cannot deny specific IPs. Denies require NACLs. Stateful.
AWS NACLs	Sequential by rule number (lowest first). Has explicit deny.	Stateless -- must allow return traffic explicitly.
Azure NSGs	Priority-based (lowest number = highest priority)	Has deny rules. Stateful. Default rules at priority 65000+.
GCP Firewall Rules	Priority-based (lowest number = highest priority)	Has deny rules. Implied deny-all ingress, allow-all egress.

Stateful vs Stateless

• Stateful (iptables with conntrack, security groups): Tracks connections. If outbound is allowed, the return traffic is automatically allowed.
• Stateless (NACLs, basic nftables without conntrack): Each packet evaluated independently. Must explicitly allow return traffic (ephemeral ports).

Patterns

Pattern 1: Linux Server Baseline (nftables)

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established/related connections
        ct state established,related accept

        # Drop invalid packets
        ct state invalid drop

        # Allow loopback
        iif "lo" accept

        # Allow ICMP (ping) with rate limiting
        ip protocol icmp icmp type echo-request limit rate 5/second accept
        ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 5/second accept

        # Allow ICMPv6 neighbor/router discovery (required for IPv6)
        ip6 nexthdr icmpv6 icmpv6 type {
            nd-neighbor-solicit,
            nd-neighbor-advert,
            nd-router-solicit,
            nd-router-advert
        } accept

        # Allow SSH from management network only
        ip saddr 10.0.1.0/24 tcp dport 22 accept

        # Allow HTTP/HTTPS (if web server)
        tcp dport { 80, 443 } accept

        # Log dropped packets (rate limited to prevent log flooding)
        limit rate 5/minute log prefix "[nftables-drop] " level warn

        # Default policy: drop (set above)
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
        # Drop all forwarded traffic unless this is a router/gateway
    }

    chain output {
        type filter hook output priority 0; policy drop;

        # Allow established/related
        ct state established,related accept

        # Allow loopback
        oif "lo" accept

        # Allow DNS
        tcp dport 53 accept
        udp dport 53 accept

        # Allow HTTP/HTTPS outbound
        tcp dport { 80, 443 } accept

        # Allow NTP
        udp dport 123 accept

        # Allow SSH outbound (for git, deployments)
        tcp dport 22 accept

        # Log dropped outbound
        limit rate 5/minute log prefix "[nftables-egress-drop] " level warn
    }
}