In this lesson, you will learn about nftables, which is a modern replacement for the iptables
command. You'll encounter it every once in a while, so you better know what it is about.
So FirewallD manages nftables rules using firewall-cmd. And ufw is using the ufw command
as a frontend. And that is convenient for easy setup. But if you really need to get
access to detailed and advanced access control, nftables is the only way. And when using nftables,
firewall-d or ufw need to be disabled. So let me show you how to first do the initial
setup. I'm showing you the slide so you can work on it for yourself if you want to before
I'm demonstrating. And after doing the initial setup, you can allow web traffic, for instance,
using a configuration like this. Let me show you. So I need to install it using dnf install
nftables. It's not installed by default, but with a simple command, it will be. And next,
I'm using systemctl enable minus minus now nftables. And let's also use a systemctl stop
firewall-d and a systemctl disable firewall-d. And to prevent any accidents, I'm also going
to mask it so that if somebody thinks, hey, firewall-d, that needs to be started, you'll
get an error message telling you that it is masked. Now I'm showing you nft list rule set,
which is showing no rules at all. That's normal because we are just beginning. So in order to do
so, I'm using nft add table inet web traffic. So the table is a collection of rules that I'm
creating right here. And next, nft, between single quotes, add chain. Within a table, you create a
chain, and a chain is a collection of rules. So in inet web traffic, I'm creating the chain with
the name input. And the type is set to filter. And we need hook input priority filter to make
it complete. And also we are going to set the policy to drop. Now here you can see that the
syntax is JSON-like syntax. And you need curly braces and semicolons and single quotes. It's
very easy to make a typo in here. And that is why in most situations, people are using easy frontends
like firewalld. Now let's use nft add rule inet web traffic, input ct, state, related, established,
accept. So what does that mean? That means that in this rule, we are going to accept answers to get
back. And following that, I'm using nft add rule inet web traffic, input, tcp, deport, 80,443,
accept. It's nice that you can specify a comma-separated list in this case. And now nft list
ruleset inet web traffic is showing the configuration. And next, if I want to verify, I can use nft list
ruleset. And that will be enough. This is showing all the rules that are currently available, nicely
formatted in this input chain. And if you like that, then you are going to repeat the command nft list
ruleset, and you write it to the configuration file etc nftables.conf. And then the only thing that you
need to do is to restart. Now, I don't want to have any problems in the remaining lessons in this course.
And for that reason, I'm going to finish this demo with a systemctl disable minus minus now on nftables.
If you don't do that, you might get into trouble later on while following other videos in this course.