nftables: Firewall Rules Without the iptables Baggage

Mon, 08 Apr 2024 08:30:00 +0000

iptables has been the default answer to “how do I write firewall rules on Linux” for so long that its warts feel normal. Four separate binaries for four protocol families (iptables, ip6tables, arptables, ebtables), each with its own syntax. Rule matching that’s a linear scan, so a ruleset with thousands of entries — a fail2ban instance with a long ban list, say — gets measurably slower per packet. No native way to group addresses or ports without either duplicating rules or reaching for the clunky ipset extension. nftables replaced all of that in the mainline kernel back in 3.13 (2014), and as of most current distributions it’s the default backend even when you type iptables out of habit — but writing rules in its native syntax rather than through the compatibility shim is where the actual improvements live.

OPNsense: A Serious Firewall for a Serious Home

Tue, 07 Nov 2023 09:00:00 +0000

The router your ISP gave you is a compromise built to a price point, and it shows the moment you ask it to do anything beyond NAT a single flat network. No VLANs, no real firewall rules beyond “allow everything out, block everything in”, a web interface that reboots the whole box to change a DNS entry, and firmware that stops receiving updates the day the model falls out of the current catalogue. It works fine for a household that just wants Netflix and email. It falls over the instant you want a guest network that can’t see your NAS, a camera VLAN that can’t phone home to the internet, or logging that tells you what actually crossed the WAN link last Tuesday.

Firewall - vo.rs

nftables: Firewall Rules Without the iptables Baggage

OPNsense: A Serious Firewall for a Serious Home