0:00–0:10
Recap
0:10–0:35
Lecture
0:35–1:50
Lab 2B
1:50–2:00
Debrief
0:00 – 0:10Recap · 10 min
From seeing traffic to controlling it
- Quick question: "In Week 1 we ran
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. Break that down." — bridges existing knowledge into today's deeper look at tables and chains.
- Frame the day: three tools, one job. By the end of today students can write the same rule set in IPTables, NFTables, and UFW, and explain when to reach for each.
0:10 – 0:35Lecture · 25 min
Netfilter architecture, IPTables and NFTables rule syntax, and where UFW fits
- Netfilter (7 min): IPTables and NFTables are both front-ends to the same kernel packet-filtering hooks. Packet flow: PREROUTING → routing decision → INPUT or FORWARD → OUTPUT → POSTROUTING. Two tables matter here: filter (INPUT/OUTPUT/FORWARD — accept/drop/reject) and nat (PREROUTING/POSTROUTING — used for MASQUERADE).
- IPTables rule anatomy (6 min):
iptables -t filter -A INPUT -p tcp --dport 22 -s 192.168.50.0/24 -j DROP — table, chain, protocol, port, source, target. Management: -A/-I/-D/-F/-L. DROP is silent (times out); REJECT sends an immediate ICMP unreachable.
- NFTables (7 min): the modern successor — no predefined tables/chains, address families (
ip/ip6/inet), pseudo-English syntax (nft add rule inet filter input tcp dport 22 drop), and handle-based deletion (nft -a list ruleset to find the handle, then nft delete rule ... handle N). Never mix IPTables and NFTables rules on the same machine.
- UFW (5 min): not a third framework — a simplified interface over iptables, ideal for a single server's common cases.
ufw enable, ufw allow/deny, ufw status numbered, ufw delete N. Not appropriate for complex multi-interface routing.
Instructor note: the packet-flow diagram is the single most important concept today — students who understand which chain a packet hits can debug their own rules. Draw it on the board before touching syntax.
0:35 – 1:50Lab 2B · 75 min
Lab 2B — Matching rule sets across all three tools, then NAT and persistence
Part 1 — IPTables and NFTables, same rules (35 min)
- Verify the filter table is empty (
sudo iptables -L -n -v). For each task: write the command, apply it, verify with tcpdump + ping/mz from S2, record it, then remove it before the next task.
- Task 1: drop all ICMP from S2. Task 2: drop telnet (port 23) from S2. Task 3: permit SSH only from S2, block from the Windows host. Flush when done (
iptables -F).
- Repeat the same three tasks in NFTables — e.g. Task 1:
sudo nft add rule inet filter input ip saddr [S2-IP] icmp type echo-request drop, verify, then find and delete by handle (nft -a list ruleset). Flush when done (nft flush ruleset).
- Rule ordering demo: deliberately add a DROP-all-ICMP rule before an ACCEPT-from-gateway rule and show that the ACCEPT is never reached. This is the most common iptables mistake — worth doing on purpose.
Part 2 — UFW, NAT, and persistence (40 min)
- Clear IPTables/NFTables first (
sudo iptables -F && sudo nft flush ruleset). Enable UFW, set explicit default policies (deny incoming / allow outgoing), then implement the same rule set: allow your SSH port, deny telnet, allow ICMP from the classroom subnet, allow DNS from LAN1. Compare ufw status verbose to the iptables rules it generated underneath.
- Delete a rule by number (
ufw status numbered → ufw delete N), then ufw reset and re-enable with SSH allowed first.
- NAT through UFW: uncomment
net/ipv4/ip_forward=1 in /etc/ufw/sysctl.conf, set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw, and add the masquerade rule to /etc/ufw/before.rules under a *nat section. Reload and test internet access from S2.
- Persistence: disable UFW, apply a simple allow-SSH/drop-rest IPTables rule, install
iptables-persistent, save with netfilter-persistent save, reboot S1, and confirm the rule survived.
SSH lockout risk: always verify SSH still works from a second session before closing the first, both when applying DROP rules and when enabling UFW. Recovery otherwise requires the Hyper-V console.
Optional take-home extension (on the handout): Tasks 4–6 from the original two-day version (DNS-only-from-S2, interface-specific SSH block on eth0, gateway-only ICMP with a two-rule ordering requirement), the conntrack -L connection-tracking bonus, and the written three-tool comparison. All remain excellent practice.
1:50 – 2:00Debrief · 10 min
- Ask: "Of the three tools, which would you choose for a production server needing SSH, web traffic, and NAT — and why?"
- Preview Wednesday: with the network locked down, we move to infrastructure services that everything else depends on — starting with time synchronisation.
Learning outcomes — by end of Day 2, students can…
Write IPTables rulesUse -t, -A/-D/-F/-L, -p, -s/-d, --dport, -j with ACCEPT/DROP/REJECT targets
Write NFTables rulesAdd rules with nft syntax and delete by handle
Configure UFW with NATEnable UFW, set default policies, add/delete rules, and configure masquerade through UFW's config files
Persist firewall rulesUse iptables-persistent to survive a reboot
Explain rule ordering and DROP vs. REJECTDemonstrate a rule-ordering failure and its fix
What you need ready before class
Lab 2B handout printed
S1 IPTables/NFTables/UFW all confirmed clean before starting