<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: configuring-firewall-rules
description: >-
  Design, implement, and audit firewall rules using iptables, nftables, and firewalld with defense-in-depth principles, default deny policies, and comprehensive logging.
domain: cybersecurity
subdomain: network-security
tags:
  - iptables
  - nftables
  - firewalld
  - ufw
  - firewall
  - packet-filter
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1562.004"]
  nist-csf: ["PR.AC-5", "PR.PT-4"]
  uuid: 06f32812-f20c-463f-a9f9-b3ca6b621871
---

# Configuring Firewall Rules

## Overview

Firewall configuration is the primary network access control. Effective firewall rules follow
default-deny, least-privilege principles with explicit allow rules for required traffic.
This skill covers iptables (legacy), nftables (modern Linux), firewalld (RHEL/CentOS),
rule auditing, logging strategies, and common security pitfalls.

Mode: `[MODE: BLUE]` for rule implementation; `[MODE: ARCHITECT]` for firewall design.

## Prerequisites

| Requirement | Details |
|---|---|
| Root access to firewall host | Required |
| iptables or nftables (Linux kernel 3.13+ for nftables) | Required |
| Understanding of TCP/IP and required service ports | Required |
| Network diagram with traffic flow requirements | Required |
| Change management process for production firewalls | Required |

## Key Concepts

### iptables Hardened Configuration

```bash
#!/bin/bash
# Hardened iptables ruleset — default deny

# Flush existing rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t mangle -F

# Default policies — DROP everything
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established/related
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from management network only
iptables -A INPUT -s 10.10.10.0/24 -p tcp --dport 22 -m state --state NEW -j ACCEPT

# Allow HTTPS inbound (web server)
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

# Allow DNS outbound
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT

# Allow NTP outbound
iptables -A OUTPUT -p udp --dport 123 -m state --state NEW -j ACCEPT

# Allow HTTPS outbound (updates)
iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

# Rate limit ICMP
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Log dropped packets
iptables -A INPUT -j LOG --log-prefix "FW-INPUT-DROP: " --log-level 4
iptables -A FORWARD -j LOG --log-prefix "FW-FORWARD-DROP: " --log-level 4
iptables -A OUTPUT -j LOG --log-prefix "FW-OUTPUT-DROP: " --log-level 4

# Final drop (explicit)
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j DROP
```

### nftables Equivalent

```bash
#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    ip saddr 10.10.10.0/24 tcp dport 22 ct state new accept
    tcp dport 443 ct state new accept
    icmp type echo-request limit rate 1/second accept
    log prefix "nft-input-drop: " drop
  }
  chain forward {
    type filter hook forward priority 0; policy drop;
    log prefix "nft-forward-drop: " drop
  }
  chain output {
    type filter hook output priority 0; policy drop;
    ct state established,related accept
    oif lo accept
    udp dport 53 ct state new accept
    tcp dport {53, 443} ct state new accept
    udp dport 123 ct state new accept
    log prefix "nft-output-drop: " drop
  }
}
```

### Firewall Audit Checks

```bash
# List all rules with counters
iptables -L -n -v --line-numbers

# Check for overly permissive rules
iptables -L -n | grep -E "0\.0\.0\.0/0.*ACCEPT"

# Check default policies
iptables -L | grep "Chain.*policy"

# Find rules that never match (dead rules)
iptables -L -n -v | awk '$1 == "0" && $2 == "0" {print NR": "$0}'
```

## Workflow

### Step 1: Document Required Flows

Create a traffic matrix: source → destination → port → protocol → justification.

### Step 2: Implement Default Deny

```bash
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
```

### Step 3: Add Allow Rules

Add rules in order of most specific to least specific.

### Step 4: Enable Logging

```bash
# Log denied traffic for analysis
iptables -A INPUT -j LOG --log-prefix "FW-DROP: " --log-level 4 \
  -m limit --limit 10/min
```

### Step 5: Persist and Verify

```bash
# Save rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6

# Verify
iptables -L -n -v --line-numbers
```

## Detection

```yaml
title: Firewall Rules Detection
id: 29769151-be7c-4d49-8fab-7f338c4a76ff
status: experimental
description: Detects suspicious activity related to configuring firewall rules techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1562.004
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Firewall Rules Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1562.004 |

## Verification

- [ ] Default deny policies on INPUT, FORWARD, OUTPUT
- [ ] Loopback traffic allowed
- [ ] Established/related connections allowed
- [ ] SSH restricted to management network
- [ ] No rules with 0.0.0.0/0 source except intended public services
- [ ] Logging enabled for dropped traffic
- [ ] Rules persisted across reboot
- [ ] IPv6 rules mirror IPv4 policy (or ip6tables -P DROP)
- [ ] Firewall rules in version control

## References

- NIST SP 800-41 Rev 1: Guidelines on Firewalls and Firewall Policy
- CIS Benchmark for Linux — Firewall Configuration
- [nftables Wiki](https://wiki.nftables.org/)
- [iptables Tutorial](https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html)
