A small nftables ruleset for Trixie

debian 13 / published / guide #3 / ≈ 2 min read

A firewall is software that decides which network traffic is allowed in and out of your computer. Without one, every service you run is exposed to the whole internet. With one, you decide what gets through.

What is nftables? It's the modern Linux firewall, the official replacement for the old iptables command. Debian uses it by default. You write rules in one human-readable file and the kernel enforces them.

Heads up: firewall rules can lock you out of a remote machine if you make a mistake. If you're configuring this over SSH, double-check that you allow port 22 before you activate any rules.

Step 1: Open the config file

sudo nano /etc/nftables.conf

Delete whatever's there and paste this ruleset (we'll walk through it below):

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        iif lo accept
        ct state established,related accept
        ct state invalid drop

        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept

        tcp dport 22 accept
        # tcp dport { 80, 443 } accept   # uncomment for a web server
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

What each rule means

  • flush ruleset — start with a clean slate.
  • policy drop — anything not explicitly allowed is rejected. (This is the safe default.)
  • iif lo accept — allow traffic on the loopback interface (programs talking to themselves).
  • ct state established,related accept — once a connection is already open (e.g. you started a web request), let the replies come back in.
  • ip protocol icmp accept — allow ping. Helpful for debugging; remove if you'd rather hide.
  • tcp dport 22 accept — allow SSH. Leave this if you're connecting remotely!
  • chain output … policy accept — your computer can talk out freely.

Step 2: Check the syntax before loading

sudo nft -c -f /etc/nftables.conf

The -c means "check, but don't apply." If there's a typo it'll tell you on which line. No output = no problems.

Step 3: Enable the firewall

sudo systemctl enable --now nftables

enable --now does two things: starts the service immediately, and arranges for it to start automatically on boot.

Step 4: Confirm it's working

sudo nft list ruleset

You should see your rules echoed back from the running kernel. If you see something else (or nothing), the file wasn't loaded — re-read step 2.

If you locked yourself out

From a local console (not SSH), wipe everything with:

sudo nft flush ruleset

That turns the firewall into a no-op until you reload /etc/nftables.conf. It's a panic button.

← back to index