4 Network Security on Arch linux
Network Security on Arch linux
1. UFW
sudo pacman -S ufw
sudo systemctl enable --now ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable
2. NFTABLES
sudo pacman -S nftables
nft --version
sudo systemctl enable nftables.service
sudo systemctl start nftables.service
sudo systemctl status nftables.service
sudo nano /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
Allow loopback traffic
iif lo accept
Accept already established/related connections
ct state established,related accept
Allow DNS
udp dport 53 ct state new accept
Allow HTTP (port 80) and HTTPS (port 443)
tcp dport { 80, 443 } accept
Log and drop everything else (optional)
log prefix "nftables input drop: " flags all counter
drop
}
chain forward {
type filter hook forward priority 0;
drop
}
chain output {
type filter hook output priority 0;
accept
}
}
Test the syntax
sudo nft -c -f /etc/nftables.conf
Load the rules:
sudo nft -f /etc/nftables.conf
View the active rules:
sudo nft list ruleset
Making the Rules Persistent
sudo reboot
sudo nft list ruleset
Visualize Dropped Packets in the log
sudo journalctl -k | grep nftables