What is a firewall and what are the main types of firewalls in Linux?

Re-explain

A firewall monitors and controls network traffic based on security rules. Linux firewall types:

Packet filtering: Network layer examination (iptables/NFTables)
Stateful: Track connection state and context
Application-level: Filter at application layer
Circuit-level: Work at session layer

Linux uses netfilter framework with iptables/NFTables as user-space utilities.

2. What is the netfilter framework?

Difficulty: Beginner
Answer:
Netfilter is a kernel framework providing hooks for packet filtering, NAT, and packet mangling at:

PREROUTING: Before routing decision
INPUT: Packets to local system
FORWARD: Packets routed through system
OUTPUT: Locally generated packets
POSTROUTING: After routing decision

iptables and NFTables configure netfilter rules from user-space.

3. Describe the main tables in iptables and their purposes.

Difficulty: Beginner
Answer:
filter table (default):

Purpose: Packet filtering (allow/deny)
Chains: INPUT, OUTPUT, FORWARD
nat table:
Purpose: Network Address Translation
Chains: PREROUTING, POSTROUTING, OUTPUT
mangle table:
Purpose: Packet alteration (TTL, TOS, MARK)
Chains: All five netfilter hooks
raw table:
Purpose: Connection tracking exemption
Chains: PREROUTING, OUTPUT
security table:
Purpose: Mandatory Access Control (SELinux)
Chains: INPUT, OUTPUT, FORWARD

4. What are iptables chains and what is the difference between built-in and user-defined chains?

Difficulty: Beginner
Answer:
Built-in chains are predefined by iptables and correspond to netfilter hooks:

INPUT, OUTPUT, FORWARD (filter table)
PREROUTING, POSTROUTING (nat/mangle tables)
User-defined chains are custom chains created by administrators:
Help organize complex rulesets
Can be called from built-in chains using -j chain_name
Must be explicitly referenced to be used

# Create user-defined chain
iptables -N custom_ssh_rules
# Add rules to custom chain
iptables -A custom_ssh_rules -s 192.168.1.0/24 -j ACCEPT
iptables -A custom_ssh_rules -j DROP
# Reference from built-in chain
iptables -A INPUT -p tcp --dport 22 -j custom_ssh_rules

5. Explain the concept of iptables targets and actions.

Difficulty: Beginner
Answer:
Targets determine what happens to packets that match a rule. Common targets include:
Terminating targets (stop rule traversal):

ACCEPT: Allow the packet
DROP: Silently discard the packet
REJECT: Discard and send error response
Non-terminating targets (continue processing):
LOG: Log packet information
MARK: Mark packet for later processing
DNAT/SNAT: Network address translation

# Terminating target
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Non-terminating target
iptables -A INPUT -p tcp --dport 443 -j LOG --log-prefix "HTTPS: "
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

6. How do you list, add, and delete iptables rules?

Difficulty: Beginner
Answer:
Listing rules:

iptables -L                    # List all rules
iptables -L INPUT             # List INPUT chain rules
iptables -L -n --line-numbers # Show with line numbers
iptables -S                   # Show rules in save format

Adding rules:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT  # Append
iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT # Insert at position 1

Deleting rules:

iptables -D INPUT 1           # Delete rule by line number
iptables -D INPUT -p tcp --dport 22 -j ACCEPT  # Delete by specification
iptables -F INPUT             # Flush all rules in INPUT chain
iptables -F                   # Flush all rules in all chains

7. What is the difference between DROP and REJECT targets?

Difficulty: Beginner
Answer:
DROP:

Silently discards the packet
No response sent to sender
Sender waits until timeout
More secure (doesn't reveal firewall presence)
Can cause connection delays
REJECT:
Discards packet and sends error response
Default sends ICMP "port unreachable"
Immediate notification to sender
Faster failure detection
Reveals firewall presence

# DROP - silent discard
iptables -A INPUT -p tcp --dport 23 -j DROP
# REJECT with custom response
iptables -A INPUT -p tcp --dport 23 -j REJECT --reject-with tcp-reset

8. How do you make iptables rules persistent across reboots?

Difficulty: Beginner
Answer:
Method 1: iptables-save/iptables-restore

# Save current rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
# Restore rules
iptables-restore < /etc/iptables/rules.v4

Method 2: Distribution-specific tools

# Debian/Ubuntu
apt install iptables-persistent
# RHEL/CentOS
systemctl enable iptables
service iptables save
# Custom script in /etc/rc.local or systemd service

9. Explain the difference between iptables and NFTables.

Difficulty: Intermediate
Answer:
iptables:

Legacy framework, part of Linux since 2.4 kernel
Uses separate tools for IPv4 (iptables) and IPv6 (ip6tables)
Fixed table and chain structure
Rule replacement requires rebuilding entire ruleset
NFTables:
Modern replacement introduced in kernel 3.13
Unified framework for IPv4, IPv6, ARP, and bridge filtering
Flexible table and chain structure
Atomic rule updates
Better performance with large rulesets
More intuitive syntax

# iptables example
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# nftables equivalent
nft add rule inet filter input tcp dport 22 accept

10. How do you implement connection state tracking in iptables?

Difficulty: Intermediate
Answer:
Connection state tracking uses the conntrack module to track connection states:
Connection states:

NEW: First packet of new connection
ESTABLISHED: Part of existing connection
RELATED: Related to existing connection (like FTP data)
INVALID: Packet doesn't match any known connection

# Allow established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow new SSH connections
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
# Drop invalid packets
iptables -A INPUT -m state --state INVALID -j DROP

11. Explain how to configure NAT using iptables.

Difficulty: Intermediate
Answer:
SNAT (Source NAT) - Changes source IP:

# Masquerade for internet sharing
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Static SNAT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 203.0.113.1

DNAT (Destination NAT) - Changes destination IP:

# Port forwarding
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:8080
# Load balancing
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100-192.168.1.103

12. How do you create and manage tables in NFTables?

Difficulty: Intermediate
Answer:
NFTables uses families (inet, ip, ip6, arp, bridge, netdev) and allows custom table names:

# Create table
nft add table inet filter
# List tables
nft list tables
# Create table with custom name
nft add table inet firewall
# Delete table
nft delete table inet filter
# Flush table (remove all chains and rules)
nft flush table inet filter

13. What are the differences between NFTables and iptables syntax?

Difficulty: Intermediate
Answer:
iptables syntax:

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

NFTables equivalent:

nft add rule inet filter input tcp dport 22 ip saddr 192.168.1.0/24 accept

Key differences:

NFTables uses more natural language
No separate commands for IPv4/IPv6
Built-in set and map support
Atomic rule updates
More flexible matching expressions

14. How do you work with sets in NFTables?

Difficulty: Intermediate
Answer:
Sets allow efficient matching against multiple values:

# Create a set
nft add set inet filter allowed_ports { type inet_service \; }
# Add elements to set
nft add element inet filter allowed_ports { 22, 80, 443 }
# Use set in rule
nft add rule inet filter input tcp dport @allowed_ports accept
# Create set with timeout
nft add set inet filter blacklist { type ipv4_addr \; timeout 1h \; }
# Anonymous set (inline)
nft add rule inet filter input ip saddr { 192.168.1.1, 192.168.1.2 } accept

15. What is the correct order for firewall rules and why does it matter?

Difficulty: Intermediate
Answer:
Rule order is critical because iptables processes rules sequentially and stops at the first match:
Correct order:

Loopback traffic (always first)
Established/Related connections
Specific allow rules (most specific first)
General allow rules
Logging rules
Default deny policy

# Correct order example
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.1.5 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j LOG --log-prefix "DROPPED: "
iptables -P INPUT DROP

16. How do you implement rate limiting in iptables?

Difficulty: Intermediate
Answer:
Rate limiting prevents flood attacks using the limit module:

# Basic rate limiting
iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min --limit-burst 5 -j ACCEPT
# SSH brute force protection
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name ssh_attacks
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 3 --name ssh_attacks -j DROP
# ICMP rate limiting
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/sec -j ACCEPT

17. Explain how to use iptables modules for advanced matching.

Difficulty: Intermediate
Answer:
iptables modules extend matching capabilities:
Time-based rules:

# Allow SSH only during business hours
iptables -A INPUT -p tcp --dport 22 -m time --timestart 09:00 --timestop 17:00 --weekdays Mon,Tue,Wed,Thu,Fri -j ACCEPT

String matching:

# Block HTTP requests containing specific strings
iptables -A FORWARD -p tcp --dport 80 -m string --string "malware" --algo bm -j DROP

Multiple port matching:

# Match multiple ports efficiently
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT

Owner matching:

# Allow only specific user to make outbound connections
iptables -A OUTPUT -m owner --uid-owner 1000 -j ACCEPT

18. How do you troubleshoot iptables rules that aren't working as expected?

Difficulty: Intermediate
Answer:
Debugging techniques:

Enable logging:

iptables -I INPUT 1 -j LOG --log-prefix "DEBUG INPUT: "
iptables -I OUTPUT 1 -j LOG --log-prefix "DEBUG OUTPUT: "

Check rule hit counts:

iptables -L -v -n  # Shows packet and byte counters

Trace packet path:

# Enable netfilter debugging
echo 1 > /proc/sys/net/netfilter/nf_log_all_netns
modprobe nf_log_ipv4
# Use TRACE target
iptables -t raw -A PREROUTING -p tcp --dport 80 -j TRACE

Common issues:

Rule order problems
Missing connection state rules
Interface specifications
Default policy conflicts

19. How do you monitor and log firewall activity?

Difficulty: Intermediate
Answer:
Logging configuration:

# Log dropped packets with rate limiting
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTABLES DROPPED: " --log-level 4
# Log to specific facility
iptables -A INPUT -j LOG --log-prefix "FIREWALL: " --log-level info
# Configure rsyslog (/etc/rsyslog.conf)
kern.info                       /var/log/firewall.log

Monitoring tools:

iptables -L -v: Real-time rule statistics
netstat -i: Interface statistics
ss -tuln: Active connections
tcpdump: Packet capture for detailed analysis

# Monitor in real-time
watch 'iptables -L -v -n'
# Analyze logs
tail -f /var/log/firewall.log | grep "DROPPED"

20. What are the security best practices for firewall configuration?

Difficulty: Intermediate
Answer:
Key principles:

Default deny policy:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP  # Optional, usually ACCEPT

Minimal exposure:

# Only allow required services
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Input validation:

# Block invalid packets
iptables -A INPUT -m state --state INVALID -j DROP
# Block private addresses on public interface
iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP

Attack prevention:

# SYN flood protection
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT
# Port scan detection
iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A INPUT -m recent --name portscan --remove
iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j LOG --log-prefix "PORTSCAN DETECTED: "

21. How do you secure iptables configuration files and prevent unauthorized changes?

Difficulty: Intermediate
Answer:
File protection:

# Set proper permissions
chmod 600 /etc/iptables/rules.v4
chown root:root /etc/iptables/rules.v4
# Use file attributes (ext2/3/4 filesystems)
chattr +i /etc/iptables/rules.v4  # Immutable

Configuration management:

Version control for rule files
Automated deployment and rollback
Regular configuration audits
Change approval processes
Monitoring changes:

# Monitor iptables changes with auditd
auditctl -a always,exit -F arch=b64 -S execve -F path=/sbin/iptables -k iptables_changes
# File integrity monitoring
aide --check

22. Explain NFTables maps and their usage.

Difficulty: Advanced
Answer:
Maps provide key-value lookups for dynamic rule actions:

# Create a map for port forwarding
nft add map inet nat portmap { type inet_service : ipv4_addr \; }
# Add elements to map
nft add element inet nat portmap { 80 : 192.168.1.100, 443 : 192.168.1.101 }
# Use map in DNAT rule
nft add rule inet nat prerouting tcp dport map @portmap dnat to tcp dport map @portmap
# Verdict map example
nft add map inet filter policy { type ipv4_addr : verdict \; }
nft add element inet filter policy { 192.168.1.100 : accept, 192.168.1.200 : drop }
nft add rule inet filter input ip saddr vmap @policy

23. How do you configure iptables for a DMZ (Demilitarized Zone)?

Difficulty: Advanced
Answer:
DMZ configuration requires careful rule placement and multiple interfaces:

# Variables
LAN_IF="eth0"
DMZ_IF="eth1" 
WAN_IF="eth2"
DMZ_NET="192.168.100.0/24"
LAN_NET="192.168.1.0/24"
# Allow established connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# LAN to DMZ (limited access)
iptables -A FORWARD -i $LAN_IF -o $DMZ_IF -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i $LAN_IF -o $DMZ_IF -p tcp --dport 443 -j ACCEPT
# WAN to DMZ (public services)
iptables -A FORWARD -i $WAN_IF -o $DMZ_IF -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i $WAN_IF -o $DMZ_IF -p tcp --dport 443 -j ACCEPT
# Block DMZ to LAN
iptables -A FORWARD -i $DMZ_IF -o $LAN_IF -j DROP
# NAT for DMZ
iptables -t nat -A POSTROUTING -s $DMZ_NET -o $WAN_IF -j MASQUERADE

24. How do you implement port knocking with iptables?

Difficulty: Advanced
Answer:
Port knocking provides stealth access by requiring a sequence of connection attempts:

# Create chains for port knocking sequence
iptables -N KNOCK1
iptables -N KNOCK2
iptables -N KNOCK3
iptables -N SSH_ALLOW
# Stage 1: Knock on port 1234
iptables -A INPUT -p tcp --dport 1234 -m recent --name knock1 --set -j DROP
iptables -A INPUT -p tcp --dport 1234 -j DROP
# Stage 2: Knock on port 2345 within 30 seconds
iptables -A INPUT -p tcp --dport 2345 -m recent --name knock1 --rcheck --seconds 30 -m recent --name knock2 --set -j DROP
# Stage 3: Knock on port 3456 within 30 seconds
iptables -A INPUT -p tcp --dport 3456 -m recent --name knock2 --rcheck --seconds 30 -m recent --name knock3 --set -j DROP
# Allow SSH after successful sequence
iptables -A INPUT -p tcp --dport 22 -m recent --name knock3 --rcheck --seconds 30 -j ACCEPT

25. How do you configure load balancing with iptables?

Difficulty: Advanced
Answer:
Load balancing distributes traffic across multiple servers:

# Random load balancing between two servers
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode random --probability 0.5 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.101:80
# Round-robin using nth module
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode nth --every 3 --packet 0 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode nth --every 3 --packet 1 -j DNAT --to-destination 192.168.1.101:80
iptables -t nat -A PREROUTING -p tcp --dport 80 -m statistic --mode nth --every 3 --packet 2 -j DNAT --to-destination 192.168.1.102:80

26. Explain how to use iptables for traffic shaping and QoS.

Difficulty: Advanced
Answer:
iptables can mark packets for traffic control (tc) processing:

# Mark different types of traffic
iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -p tcp --dport 22 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 3
# DSCP marking for VoIP traffic
iptables -t mangle -A OUTPUT -p udp --dport 5060:5090 -j DSCP --set-dscp-class EF
# Then use tc for actual traffic shaping
tc qdisc add dev eth0 root handle 1: htb default 30
tc class add dev eth0 parent 1: classid 1:1 htb rate 100mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 80mbit ceil 100mbit # HTTP/HTTPS
tc class add dev eth0 parent 1:1 classid 1:20 htb rate 15mbit ceil 20mbit   # SSH

27. What are the performance considerations when working with large iptables rulesets?

Difficulty: Advanced
Answer:
Performance optimization strategies:

Rule organization:

# Put most frequently matched rules first
iptables -I INPUT 1 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Use user-defined chains to reduce rule traversal
iptables -N HTTP_RULES
iptables -A INPUT -p tcp --dport 80 -j HTTP_RULES

Use efficient matches:

# Use multiport instead of multiple rules
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT
# Use ipset for large IP lists
ipset create allowed_ips hash:ip
ipset add allowed_ips 192.168.1.1
iptables -A INPUT -m set --match-set allowed_ips src -j ACCEPT

Avoid expensive operations:

Minimize string matching
Reduce LOG rules in high-traffic paths
Use connection tracking efficiently

28. Explain the concept of fail-safe firewall configuration.

Difficulty: Advanced
Answer:
Fail-safe configuration ensures network access is maintained during firewall updates:
Safe update procedure:

#!/bin/bash
# Fail-safe iptables update script
# Set temporary rule to allow SSH
iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT
# Schedule rule removal (safety net)
echo "iptables -D INPUT 1" | at now + 10 minutes
# Apply new ruleset
iptables-restore < /etc/iptables/new-rules.v4
# If successful, cancel the safety rule removal
atrm [job_number]
# Remove temporary rule
iptables -D INPUT 1

Remote management considerations:

Always test rules locally first
Use screen/tmux for persistent sessions
Implement automatic rollback mechanisms
Maintain out-of-band access methods

29. How do you implement application-layer filtering beyond basic port blocking?

Difficulty: Advanced
Answer:
Deep packet inspection:

# Block specific HTTP user agents
iptables -A INPUT -p tcp --dport 80 -m string --string "User-Agent: badbot" --algo bm -j DROP
# Block SQL injection attempts
iptables -A INPUT -p tcp --dport 80 -m string --string "SELECT * FROM" --algo bm -j LOG --log-prefix "SQL_INJECTION: "
# Protocol-specific filtering (requires l7-filter)
iptables -A FORWARD -m layer7 --l7proto bittorrent -j DROP

Integration with application firewalls:

Combine iptables with mod_security (Apache)
Use iptables to direct traffic to application proxies
Implement traffic inspection at application gateways

30. What are common iptables misconfigurations and how do you avoid them?

Difficulty: Advanced
Answer:
Common mistakes:

Incorrect rule order:

# Wrong - specific rule after general rule
iptables -A INPUT -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT  # Never reached
# Correct
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

Missing loopback rules:

# Always allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

Forgetting established connections:

# Essential for stateful filtering
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Not considering OUTPUT rules:

# If OUTPUT policy is DROP, allow necessary outbound traffic
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT  # DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT  # DNS

Prevention strategies:

Use configuration management tools
Implement automated testing
Regular rule audits and cleanup
Documentation of rule purposes
Staged deployment processes

Rewriting in plainer words…

This answer doesn't lend itself to a diagram - it reads best . No credits were charged.

The model's verdict: “”

The interactive diagram is below the answer - jump to diagram ↓

This answer is explained by a shared concept diagram - open →

Tailored explanation · switch back to · ·

Point the redraw: