nftables host firewall baseline

Purpose

Apply a minimal default-deny host firewall while keeping SSH reachable.

Requirements

• Console or recovery access.
• Confirmed SSH source address.
• List of service ports that must stay reachable.

Commands

sudo apt install nftables
sudo systemctl enable --now nftables
sudo nft list ruleset

Config files

/etc/nftables.conf

table inet filter {
  chain input {
    type filter hook input priority 0;
    policy drop;

    iif lo accept
    ct state established,related accept
    tcp dport 22 accept
    icmp type echo-request accept
  }
}

Checks

sudo nft -c -f /etc/nftables.conf
sudo systemctl reload nftables
sudo nft list ruleset
ssh example-server

Rollback

Flush the temporary ruleset from console access with sudo nft flush ruleset, restore the previous /etc/nftables.conf, and restart nftables.

Related notes

• nftables quick check