Bug 1694723

Description:

When iptables or firewalld are used, there is a default configuration that allows some common services and deny all the rest. This is not valid for nftables though, as upon activation, all the traffic is allowed.

I quickly tested by deploying a RHEL7.5, disabling firewalld and installing nftables. Then I put ncat in listening on 12345 port and I was able to establish a connection from a remote host. With firewalld/iptables I would have to open the new port which is also good for security purposes (white-list approach).


Customer stated:
================================================================
What I missed most was the default nftables rules file that you can just take in the use like in iptables. In RHEL and Fedora there was this file:

cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

You just started adding allow rules to it. It was very simple. And that is why I sent you my default nftables template so that there could be some kind of default nftables configuration in RHEL/Fedora that would be secure and works out-of-box. You just need to enable the configuration (for example uncomment a line in /etc/sysconfig/nftables.conf and enable nftables via systemctl) and you are ready to go with secure firewall.
================================================================

Version-Release number of selected component (if applicable):
# rpm -qa | grep nft
libnftnl-1.0.8-1.el7.x86_64
nftables-0.8-10.el7.x86_64



Customer also proposed similar config (nftables.default file):
#! /usr/sbin/nft -f

table ip filter {
  chain input {
    type filter hook input priority 0;

    ct state established,related counter accept
    ip protocol icmp counter accept
    iif lo accept
    ct state invalid counter drop

    ct state new tcp dport 22 counter accept

    # multicast DNS (mdns)
    ct state new ip daddr 224.0.0.251 udp dport 5353 counter accept

    limit rate 3 / minute log flags ip options flags tcp options prefix "FW "
    counter reject with icmp type host-prohibited
  }

  chain forward {
    type filter hook forward priority 0;
    counter reject with icmp type host-prohibited
  }
}

table ip6 filter {
  chain input {
    type filter hook input priority 0;

    ct state established,related counter accept
    meta l4proto ipv6-icmp counter accept
    iif lo accept
    ct state invalid counter drop

    # dhcpv6-client
    ct state new ip6 daddr fe80::/64 udp dport 546 counter accept
    # multicast DNS (mdns)
    ct state new ip6 daddr ff02::fb udp dport 5353 counter accept

    limit rate 3 / minute log flags ip options flags tcp options prefix "FW "
    counter reject with icmpv6 type admin-prohibited
  }

  chain forward {
    type filter hook forward priority 0;
    counter reject with icmpv6 type admin-prohibited
  }
}