Firewalls and Rulesets

A firewall that allows everything outbound and half of everything inbound is theater. You see it constantly: a box with a hundred rules, and buried in there is an ACCEPT on 0.0.0.0/0 that someone added at 2am to fix a broken deploy and never removed. That one line is the whole attack surface. Filtering packets is easy. Writing rules that fail closed instead of open is the hard part, and it is where most setups fall down.

Start with what the firewall actually decides. Every packet that hits it gets matched against your rules top to bottom, and the first match wins. What happens when nothing matches is the single most important choice you make. That is your default policy.

Stateless vs stateful

A stateless filter looks at each packet alone. Source IP, destination IP, port, protocol, done. It has no memory that you sent a SYN out three milliseconds ago, so when the SYN-ACK comes back it has to be allowed by a separate explicit rule. That means you end up writing rules for both directions of every conversation, and the return-traffic rules are wide by necessity. Wide rules are where attackers live.

Stateful is the default you want. The firewall tracks connections in a table: this outbound TCP session is ESTABLISHED, so its return packets are expected and allowed without a rule that says "let anything from port 443 back in." You allow the outbound connection once, and the reply traffic rides the connection state. Smaller ruleset, tighter surface, fewer mistakes.

# stateful accept: let replies to connections you started come back
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

That one rule replaces a pile of stateless return-path rules, and it does not open a hole a scanner can walk through, because a packet only matches if it belongs to a connection the box already tracked.

Default deny, then allow what you need

Set the policy to drop, then open the specific things that must work. Never the other way around.

Notice the SSH rule is scoped to a source range. Opening 22 to the whole internet is the difference between a bastion and a brute-force magnet. If a rule does not name a source, ask why it is that generous.

The order matters as much as the rules. Because first match wins, a broad ACCEPT placed above a narrow DROP makes the DROP dead code. Read your ruleset top down the way the kernel does and find the first rule that swallows traffic you meant to filter later.

Egress matters as much as ingress

Most people lock down inbound and let outbound run wide open. That is backwards for containing a breach. Once an attacker has a shell on an internal host, the outbound rules decide whether their reverse shell to attacker.example:4444 connects and whether they can exfiltrate over a random high port. Filter egress to the ports and destinations your services genuinely need. A web server almost never needs to make arbitrary outbound TCP connections to the internet, so do not let it.

On modern systems nftables is the successor to iptables and uses one unified framework with a cleaner syntax. The concepts are identical: default policy, state matching, first-match ordering. Learn the model once and the tool is just syntax.