The silence that cost an afternoon
A firewall rule decides what happens to a packet: let it through, drop it in silence or reject it with a reply. That choice decides what the other side sees, and how fast a fault is found.
A developer cannot reach a test server. The page just hangs. She waits, tries again and rings the network team.
A refusal would have told her in a second that the server was up. Silence told her nothing.
By the end of this lesson
Note
I can predict what a sender sees when a firewall rule drops or rejects it.
Key words
| Word | What it means | Example |
|---|---|---|
| Firewall | rules that decide which packets may pass | |
| Chain | a list of rules, checked in order | |
| Policy | what happens to a packet that no rule matches | |
| Drop | to throw a packet away with no reply | |
| Reject | to refuse a packet and tell the sender | |
| Hook | the point in a packet's journey where a chain is checked | input |
The cells students fill in are left blank in this preview.
A chain is a list with a policy
A firewall keeps rules in a chain. A packet is checked against the rules from the top. The first rule that matches decides, and the rest are not read.
If no rule matches, the policy decides. The gateway's chain here has the policy drop, so it only lets through what a rule allows.
Read the gateway's forward chain
sudo ip netns exec gw nft list chain inet filter forwardShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: reading that chain line by line
| Line | In plain words |
|---|---|
| hook forward ... policy drop | Check packets passing through, and drop what no rule allows |
| ct state established,related accept | Let through replies to connections that are already open |
| iifname "to-lan" accept | Let through anything that comes in from the LAN cable |
The cells students fill in are left blank in this preview.
A rule on one machine drops a port
Now you write a rule yourself, on the LAN machine and not on the gateway. It goes in a table of its own, called practice, and nothing is saved.
First a table, then a chain on the input hook, which sees packets arriving at that machine, and then one rule.
Make a table on the LAN machine
sudo ip netns exec lan nft add table inet practiceShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Add a chain on the input hook
sudo ip netns exec lan nft add chain inet practice guard '{ type filter hook input priority 0 ; policy accept ; }'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Add a rule that drops port 8081
sudo ip netns exec lan nft add rule inet practice guard tcp dport 8081 dropShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask port 80, which no rule touches
sudo ip netns exec gw curl --noproxy '*' -sS -m 3 -o /dev/null -w '%{http_code}\n' http://10.0.0.2/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask port 8081, which the rule drops
sudo ip netns exec gw curl --noproxy '*' -sS -m 3 http://10.0.0.2:8081/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Reject says no out loud
A drop gives no reply, so the sender waits until it gives up. A reject sends a refusal straight back, so the sender knows in an instant.
Drop is quieter for the outside. Reject is kinder to your own colleagues, who find the fault faster.
Empty the chain
sudo ip netns exec lan nft flush chain inet practice guardShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Add a rule that rejects port 8081
sudo ip netns exec lan nft add rule inet practice guard tcp dport 8081 reject with tcp resetShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Knock on port 8081 again
sudo ip netns exec gw nc -zv -w 2 10.0.0.2 8081Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think a blocked port always shows Connection refused. It does only when the firewall rejects. When it drops, the sender sees a timeout, and a timeout looks the same as a machine that is switched off.
The first rule that matches wins
Rules are read from the top. A new rule added with add goes to the bottom. A rule added with insert goes to the top.
You now let one machine, the gateway at 10.0.0.1, through to port 8081, while everybody else is still rejected.
Insert an accept rule above the reject
sudo ip netns exec lan nft insert rule inet practice guard ip saddr 10.0.0.1 tcp dport 8081 acceptShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask port 8081 from the gateway again
sudo ip netns exec gw curl --noproxy '*' -sS -m 3 http://10.0.0.2:8081/Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Delete the practice table
sudo ip netns exec lan nft delete table inet practiceShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further: count the matches
Make the table and the chain again. Add the rule tcp dport 8081 counter reject with tcp reset, then knock on port 8081 three times with nc.
List the table with sudo ip netns exec lan nft list table inet practice. What does the counter say, and why would a network team want one? Delete the table afterwards.