A firewall monitors and controls network traffic based on security rules. Linux firewall types:

• Packet filtering: Network layer examination (iptables/NFTables)
• Stateful: Track connection state and context
• Application-level: Filter at application layer
• Circuit-level: Work at session layer

Linux uses netfilter framework with iptables/NFTables as user-space utilities.

2. What is the netfilter framework?

Difficulty: Beginner
Answer:
Netfilter is a kernel framework providing hooks for packet filtering, NAT, and packet mangling at:

• PREROUTING: Before routing decision
• INPUT: Packets to local system
• FORWARD: Packets routed through system
• OUTPUT: Locally generated packets
• POSTROUTING: After routing decision

iptables and NFTables configure netfilter rules from user-space.

3. Describe the main tables in iptables and their purposes.

Difficulty: Beginner
Answer:
filter table (default):

• Purpose: Packet filtering (allow/deny)
• Chains: INPUT, OUTPUT, FORWARD
  nat table:
• Purpose: Network Address Translation
• Chains: PREROUTING, POSTROUTING, OUTPUT
  mangle table:
• Purpose: Packet alteration (TTL, TOS, MARK)
• Chains: All five netfilter hooks
  raw table:
• Purpose: Connection tracking exemption
• Chains: PREROUTING, OUTPUT
  security table:
• Purpose: Mandatory Access Control (SELinux)
• Chains: INPUT, OUTPUT, FORWARD

4. What are iptables chains and what is the difference between built-in and user-defined chains?

Difficulty: Beginner
Answer:
Built-in chains are predefined by iptables and correspond to netfilter hooks:

• INPUT, OUTPUT, FORWARD (filter table)
• PREROUTING, POSTROUTING (nat/mangle tables)
  User-defined chains are custom chains created by administrators:
• Help organize complex rulesets
• Can be called from built-in chains using -j chain_name
• Must be explicitly referenced to be used

# Create user-defined chain
iptables -N custom_ssh_rules
# Add rules to custom chain
iptables -A custom_ssh_rules -s 192.168.1.0/24 -j ACCEPT
iptables -A custom_ssh_rules -j DROP
# Reference from built-in chain
iptables -A INPUT -p tcp --dport 22 -j custom_ssh_rules

5. Explain the concept of iptables targets and actions.

Difficulty: Beginner
Answer:
Targets determine what happens to packets that match a rule. Common targets include:
Terminating targets (stop rule traversal):

• ACCEPT: Allow the packet
• DROP: Silently discard the packet
• REJECT: Discard and send error response
  Non-terminating targets (continue processing):
• LOG: Log packet information
• MARK: Mark packet for later processing
• DNAT/SNAT: Network address translation

# Terminating target
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Non-terminating target
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "HTTPS: "
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

6. How do you list, add, and delete iptables rules?

Difficulty: Beginner
Answer:
Listing rules:

iptables -L                    # List all rules
iptables -L INPUT             # List INPUT chain rules
iptables -L -n --line-numbers # Show with line numbers
iptables -S                   # Show rules in save format

Adding rules:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT  # Append
iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT # Insert at position 1

Deleting rules:

iptables -D INPUT 1           # Delete rule by line number
iptables -D INPUT -p tcp --dport 22 -j ACCEPT  # Delete by specification
iptables -F INPUT             # Flush all rules in INPUT chain
iptables -F                   # Flush all rules in all chains

7. What is the difference between DROP and REJECT targets?

Difficulty: Beginner
Answer:
DROP:

• Silently discards the packet
• No response sent to sender
• Sender waits until timeout
• More secure (doesn't reveal firewall presence)
• Can cause connection delays
  REJECT:
• Discards packet and sends error response
• Default sends ICMP "port unreachable"
• Immediate notification to sender
• Faster failure detection
• Reveals firewall presence

# DROP - silent discard
iptables -A INPUT -p tcp --dport 23 -j DROP
# REJECT with custom response
iptables -A INPUT -p tcp --dport 23 -j REJECT --reject-with tcp-reset

8. How do you make iptables rules persistent across reboots?

Difficulty: Beginner
Answer:
Method 1: iptables-save/iptables-restore

# Save current rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
# Restore rules
iptables-restore < /etc/iptables/rules.v4

Method 2: Distribution-specific tools

# Debian/Ubuntu
apt install iptables-persistent
# RHEL/CentOS
systemctl enable iptables
service iptables save
# Custom script in /etc/rc.local or systemd service

9. Explain the difference between iptables and NFTables.

Difficulty: Intermediate
Answer:
iptables:

• Legacy framework, part of Linux since 2.4 kernel
• Uses separate tools for IPv4 (iptables) and IPv6 (ip6tables)
• Fixed table and chain structure
• Rule replacement requires rebuilding entire ruleset
  NFTables:
• Modern replacement introduced in kernel 3.13
• Unified framework for IPv4, IPv6, ARP, and bridge filtering
• Flexible table and chain structure
• Atomic rule updates
• Better performance with large rulesets
• More intuitive syntax

# iptables example
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# nftables equivalent
nft add rule inet filter input tcp dport 22 accept

10. How do you implement connection state tracking in iptables?

Difficulty: Intermediate
Answer:
Connection state tracking uses the conntrack module to track connection states:
Connection states:

• NEW: First packet of new connection
• ESTABLISHED: Part of existing connection
• RELATED: Related to existing connection (like FTP data)
• INVALID: Packet doesn't match any known connection

# Allow established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow new SSH connections
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
# Drop invalid packets
iptables -A INPUT -m state --state INVALID -j DROP

11. Explain how to configure NAT using iptables.

Difficulty: Intermediate
Answer:
SNAT (Source NAT) - Changes source IP:

# Masquerade for internet sharing
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Static SNAT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 203.0.113.1

DNAT (Destination NAT) - Changes destination IP:

# Port forwarding
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:8080
# Load balancing
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100-192.168.1.103

12. How do you create and manage tables in NFTables?

Difficulty: Intermediate
Answer:
NFTables uses families (inet, ip, ip6, arp, bridge, netdev) and allows custom table names:

# Create table
nft add table inet filter
# List tables
nft list tables
# Create table with custom name
nft add table inet firewall
# Delete table
nft delete table inet filter
# Flush table (remove all chains and rules)
nft flush table inet filter

13. What are the differences between NFTables and iptables syntax?

Difficulty: Intermediate
Answer:
iptables syntax:

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

NFTables equivalent:

nft add rule inet filter input tcp dport 22 ip saddr 192.168.1.0/24 accept

Key differences:

• NFTables uses more natural language
• No separate commands for IPv4/IPv6
• Built-in set and map support
• Atomic rule updates
• More flexible matching expressions

14. How do you work with sets in NFTables?

Difficulty: Intermediate
Answer:
Sets allow efficient matching against multiple values:

# Create a set
nft add set inet filter allowed_ports { type inet_service \; }
# Add elements to set
nft add element inet filter allowed_ports { 22, 80, 443 }
# Use set in rule
nft add rule inet filter input tcp dport @allowed_ports accept
# Create set with timeout
nft add set inet filter blacklist { type ipv4_addr \; timeout 1h \; }
# Anonymous set (inline)
nft add rule inet filter input ip saddr { 192.168.1.1, 192.168.1.2 } accept

15. What is the correct order for firewall rules and why does it matter?

Difficulty: Intermediate
Answer:
Rule order is critical because iptables processes rules sequentially and stops at the first match:
Correct order:

1. Loopback traffic (always first)
2. Established/Related connections
3. Specific allow rules (most specific first)
4. General allow rules
5. Logging rules
6. Default deny policy

# Correct order example
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.1.5 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j LOG --log-prefix "DROPPED: "
iptables -P INPUT DROP

16. How do you implement rate limiting in iptables?

Difficulty: Intermediate
Answer:
Rate limiting prevents flood attacks using the limit module:

# Basic rate limiting
iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min --limit-burst 5 -j ACCEPT
# SSH brute force protection
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name ssh_attacks
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 3 --name ssh_attacks -j DROP
# ICMP rate limiting
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/sec -j ACCEPT

17. Explain how to use iptables modules for advanced matching.

Difficulty: Intermediate
Answer:
iptables modules extend matching capabilities:
Time-based rules:

# Allow SSH only during business hours
iptables -A INPUT -p tcp --dport 22 -m time --timestart 09:00 --timestop 17:00 --weekdays Mon,Tue,Wed,Thu,Fri -j ACCEPT

String matching:

# Block HTTP requests containing specific strings
iptables -A FORWARD -p tcp --dport 80 -m string --string "malware" --algo bm -j DROP

Multiple port matching:

# Match multiple ports efficiently
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT

Owner matching:

# Allow only specific user to make outbound connections
iptables -A OUTPUT -m owner --uid-owner 1000 -j ACCEPT

18. How do you troubleshoot iptables rules that aren't working as expected?

Difficulty: Intermediate
Answer:
Debugging techniques:

1. Enable logging:

iptables -I INPUT 1 -j LOG --log-prefix "DEBUG INPUT: "
iptables -I OUTPUT 1 -j LOG --log-prefix "DEBUG OUTPUT: "

2. Check rule hit counts:

iptables -L -v -n  # Shows packet and byte counters

3. Trace packet path:

# Enable netfilter debugging
echo 1 > /proc/sys/net/netfilter/nf_log_all_netns
modprobe nf_log_ipv4
# Use TRACE target
iptables -t raw -A PREROUTING -p tcp --dport 80 -j TRACE

4. Common issues:

• Rule order problems
• Missing connection state rules
• Interface specifications
• Default policy conflicts

19. How do you monitor and log firewall activity?

Difficulty: Intermediate
Answer:
Logging configuration:

# Log dropped packets with rate limiting
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTABLES DROPPED: " --log-level 4
# Log to specific facility
iptables -A INPUT -j LOG --log-prefix "FIREWALL: " --log-level info
# Configure rsyslog (/etc/rsyslog.conf)
kern.info                       /var/log/firewall.log

Monitoring tools:

• iptables -L -v: Real-time rule statistics
• netstat -i: Interface statistics
• ss -tuln: Active connections
• tcpdump: Packet capture for detailed analysis

# Monitor in real-time
watch 'iptables -L -v -n'
# Analyze logs
tail -f /var/log/firewall.log | grep "DROPPED"

20. What are the security best practices for firewall configuration?

Difficulty: Intermediate
Answer:
Key principles:

1. Default deny policy:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP  # Optional, usually ACCEPT

2. Minimal exposure:

# Only allow required services
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

3. Input validation:

# Block invalid packets
iptables -A INPUT -m state --state INVALID -j DROP
# Block private addresses on public interface
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP

4. Attack prevention:

# SYN flood protection
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
# Port scan detection
iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A INPUT -m recent --name portscan --remove
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "PORTSCAN DETECTED: "

21. How do you secure iptables configuration files and prevent unauthorized changes?

Difficulty: Intermediate
Answer:
File protection:

# Set proper permissions
chmod 600 /etc/iptables/rules.v4
chown root:root /etc/iptables/rules.v4
# Use file attributes (ext2/3/4 filesystems)
chattr +i /etc/iptables/rules.v4  # Immutable

Configuration management:

• Version control for rule files
• Automated deployment and rollback
• Regular configuration audits
• Change approval processes
  Monitoring changes:

# Monitor iptables changes with auditd
auditctl -a always,exit -F arch=b64 -S execve -F path=/sbin/iptables -k iptables_changes
# File integrity monitoring
aide --check

22. Explain NFTables maps and their usage.

Difficulty: Advanced
Answer:
Maps provide key-value lookups for dynamic rule actions:

# Create a map for port forwarding
nft add map inet nat portmap { type inet_service : ipv4_addr \; }
# Add elements to map
nft add element inet nat portmap { 80 : 192.168.1.100, 443 : 192.168.1.101 }
# Use map in DNAT rule
nft add rule inet nat prerouting tcp dport map @portmap dnat to tcp dport map @portmap
# Verdict map example
nft add map inet filter policy { type ipv4_addr : verdict \; }
nft add element inet filter policy { 192.168.1.100 : accept, 192.168.1.200 : drop }
nft add rule inet filter input ip saddr vmap @policy

23. How do you configure iptables for a DMZ (Demilitarized Zone)?

Difficulty: Advanced
Answer:
DMZ configuration requires careful rule placement and multiple interfaces:

# Variables
LAN_IF="eth0"
DMZ_IF="eth1" 
WAN_IF="eth2"
DMZ_NET="192.168.100.0/24"
LAN_NET="192.168.1.0/24"
# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# LAN to DMZ (limited access)
iptables -A FORWARD -i $LAN_IF -o $DMZ_IF -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i $LAN_IF -o $DMZ_IF -p tcp --dport 443 -j ACCEPT
# WAN to DMZ (public services)
iptables -A FORWARD -i $WAN_IF -o $DMZ_IF -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i $WAN_IF -o $DMZ_IF -p tcp --dport 443 -j ACCEPT
# Block DMZ to LAN
iptables -A FORWARD -i $DMZ_IF -o $LAN_IF -j DROP
# NAT for DMZ
iptables -t nat -A POSTROUTING -s $DMZ_NET -o $WAN_IF -j MASQUERADE

24. How do you implement port knocking with iptables?

Difficulty: Advanced
Answer:
Port knocking provides stealth access by requiring a sequence of connection attempts:

# Create chains for port knocking sequence
iptables -N KNOCK1
iptables -N KNOCK2
iptables -N KNOCK3
iptables -N SSH_ALLOW
# Stage 1: Knock on port 1234
iptables -A INPUT -p tcp --dport 1234 -m recent --name knock1 --set -j DROP
iptables -A INPUT -p tcp --dport 1234 -j DROP
# Stage 2: Knock on port 2345 within 30 seconds
iptables -A INPUT -p tcp --dport 2345 -m recent --name knock1 --rcheck --seconds 30 -m recent --name knock2 --set -j DROP
# Stage 3: Knock on port 3456 within 30 seconds
iptables -A INPUT -p tcp --dport 3456 -m recent --name knock2 --rcheck --seconds 30 -m recent --name knock3 --set -j DROP
# Allow SSH after successful sequence
iptables -A INPUT -p tcp --dport 22 -m recent --name knock3 --rcheck --seconds 30 -j ACCEPT

25. How do you configure load balancing with iptables?

Difficulty: Advanced
Answer:
Load balancing distributes traffic across multiple servers:

# Random load balancing between two servers
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode random --probability 0.5 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.101:80
# Round-robin using nth module
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode nth --every 3 --packet 0 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode nth --every 3 --packet 1 -j DNAT --to-destination 192.168.1.101:80
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode nth --every 3 --packet 2 -j DNAT --to-destination 192.168.1.102:80

26. Explain how to use iptables for traffic shaping and QoS.

Difficulty: Advanced
Answer:
iptables can mark packets for traffic control (tc) processing:

# Mark different types of traffic
iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -p tcp --dport 22 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 3
# DSCP marking for VoIP traffic
iptables -t mangle -A OUTPUT -p udp --dport 5060:5090 -j DSCP --set-dscp-class EF
# Then use tc for actual traffic shaping
tc qdisc add dev eth0 root handle 1: htb default 30
tc class add dev eth0 parent 1: classid 1:1 htb rate 100mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 80mbit ceil 100mbit # HTTP/HTTPS
tc class add dev eth0 parent 1:1 classid 1:20 htb rate 15mbit ceil 20mbit   # SSH

27. What are the performance considerations when working with large iptables rulesets?

Difficulty: Advanced
Answer:
Performance optimization strategies:

1. Rule organization:

# Put most frequently matched rules first
iptables -I INPUT 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Use user-defined chains to reduce rule traversal
iptables -N HTTP_RULES
iptables -A INPUT -p tcp --dport 80 -j HTTP_RULES

2. Use efficient matches:

# Use multiport instead of multiple rules
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT
# Use ipset for large IP lists
ipset create allowed_ips hash:ip
ipset add allowed_ips 192.168.1.1
iptables -A INPUT -m set --match-set allowed_ips src -j ACCEPT

3. Avoid expensive operations:

• Minimize string matching
• Reduce LOG rules in high-traffic paths
• Use connection tracking efficiently

28. Explain the concept of fail-safe firewall configuration.

Difficulty: Advanced
Answer:
Fail-safe configuration ensures network access is maintained during firewall updates:
Safe update procedure:

#!/bin/bash
# Fail-safe iptables update script
# Set temporary rule to allow SSH
iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
# Schedule rule removal (safety net)
echo "iptables -D INPUT 1" | at now + 10 minutes
# Apply new ruleset
iptables-restore < /etc/iptables/new-rules.v4
# If successful, cancel the safety rule removal
atrm [job_number]
# Remove temporary rule
iptables -D INPUT 1

Remote management considerations:

• Always test rules locally first
• Use screen/tmux for persistent sessions
• Implement automatic rollback mechanisms
• Maintain out-of-band access methods

29. How do you implement application-layer filtering beyond basic port blocking?

Difficulty: Advanced
Answer:
Deep packet inspection:

# Block specific HTTP user agents
iptables -A INPUT -p tcp --dport 80 -m string --string "User-Agent: badbot" --algo bm -j DROP
# Block SQL injection attempts
iptables -A INPUT -p tcp --dport 80 -m string --string "SELECT * FROM" --algo bm -j LOG --log-prefix "SQL_INJECTION: "
# Protocol-specific filtering (requires l7-filter)
iptables -A FORWARD -m layer7 --l7proto bittorrent -j DROP

Integration with application firewalls:

• Combine iptables with mod_security (Apache)
• Use iptables to direct traffic to application proxies
• Implement traffic inspection at application gateways

30. What are common iptables misconfigurations and how do you avoid them?

Difficulty: Advanced
Answer:
Common mistakes:

1. Incorrect rule order:

# Wrong - specific rule after general rule
iptables -A INPUT -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT  # Never reached
# Correct
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

2. Missing loopback rules:

# Always allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

3. Forgetting established connections:

# Essential for stateful filtering
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

4. Not considering OUTPUT rules:

# If OUTPUT policy is DROP, allow necessary outbound traffic
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT  # DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT  # DNS

Prevention strategies:

• Use configuration management tools
• Implement automated testing
• Regular rule audits and cleanup
• Documentation of rule purposes
• Staged deployment processes