nft tips — authorized nftables literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may list/change nftables (lab VM / syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any write — never flush production tables without change control.
3. Record short factual notes; quote short Evidence (table/chain names, policy, selected rule counts — never secrets).
4. Optional: legacy filter → iptables-tips.
5. Optional: zone daemon → firewalld-tips.
6. Optional: frontend → ufw-tips.
7. Prefer nft list ruleset on lab hosts; redact addresses when notes leave the lab.
8. Stop at literacy — no attack or unauthorized flush cookbooks.

Allowed framing

• Classroom labs listing nftables tables and chains on authorized hosts.
• Binding short factual notes as Evidence (table/family/chain/policy only).
• Documenting expected vs observed input policy for authorized inventory notes.
• Comparing nft ↔ iptables / firewalld / ufw peer tip pages under one binder.
• Set / map / verdict drills when the syllabus authorizes those features.

Scope we will not cover

• No crack/pirate/keygen via nft.
• No intentional firewall-bypass PoCs against foreign hosts.
• No unauthorized nft flush ruleset against systems you do not own.
• No covert channel / evasion cookbooks framed as "nft tips".

Beginner path (authorized only)

1. Obtain one syllabus-approved lab host with nftables installed.
2. Run nft list tables (and optionally nft list ruleset); quote table/chain names as Evidence.
3. Optional: compare family names (inet, ip, ip6) you actually see.
4. Optional: pair with iptables-tips if the lab still has legacy rules, or firewalld-tips if firewalld owns the backend.
5. Stop at literacy — no attack or unauthorized nft-change cookbooks.

Practical notes for authorized labs

• inet family covers IPv4+IPv6 in one table — note family explicitly in binders.
• Sets and maps are powerful; for Evidence, quote names and element counts rather than full address lists when sensitive.
• nft -a list ruleset adds handles useful for lab deletes — label lab-only experiments clearly.
• Prefer saving a lab ruleset with nft list ruleset > lab.nft under restrictive modes; never commit production dumps with customer IPs.
• Pair with ss-tips / tcpdump-tips when correlating listeners and packets on the same authorized host.
• If firewalld is active, treat firewalld as the management plane and keep firewalld-tips as the primary note.

FAQ-aligned refusals (quick)

• Foreign-host ruleset flushes → refuse.
• Unauthorized port-open cookbooks → refuse.
• Evasion / tunnel cookbooks → refuse.

For legal, authorized and educational use only.

FAQ

Sources