A firewall policy must match the packet path, family, and chain order

Wed, 01 Jul 2026 00:00:00 +0000

A firewall applies packet policy at particular points in a network stack. A useful rule therefore names more than a port: its address family, hook, direction, state conditions, and place among other rules matter. With nftables, base chains attach to Netfilter hooks at specified priorities. The effective packet path, rather than the order of descriptions in an operations document, determines which decisions a packet encounters.

When it breaks

Filtering the wrong hook can leave the intended traffic unaffected. INPUT applies to traffic delivered locally in that namespace; FORWARD applies to traffic routed through it; OUTPUT concerns locally generated traffic. A host’s container-forwarding path is not necessarily its local input path. Identify the network namespace and hook traversed by the actual flow before assuming that a host-level rule protects every nearby service.

Family and direction mistakes are similarly easy to hide. Allowing a service’s TCP destination port differs from matching a client’s source port, which is commonly ephemeral. An IPv4-only policy does not automatically cover IPv6. IPv6 communication also depends on ICMPv6 functions such as neighbor discovery, so dropping every non-TCP packet can break a connection whose TCP port appears correctly allowed.

An nftables accept verdict is not necessarily the final decision across all base chains. Another chain attached to the same hook at a later priority can still drop the packet. A drop, by contrast, ends its traversal. Auditing only one table or chain can therefore explain an allow counter increasing while the client still fails. Read the complete applicable ruleset and its hook priorities.

Check it quickly

Save this as check-firewall.py and run python3 check-firewall.py with Docker. The pinned environment uses nftables 1.0.6 and Python 3.11.16. Two nested namespaces communicate over a disposable veth pair using IPv4 and IPv6. The container receives NET_ADMIN and SYS_ADMIN for the laboratory; its rules do not modify the host firewall or an existing service:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

with lab(['client','target']) as (root,stack,setting):
 wire('client','c0','target','t0',['192.0.2.1/30','2001:db8:1::1/64'],['192.0.2.2/30','2001:db8:1::2/64'])
 addresses=['192.0.2.2','2001:db8:1::2']
 for address in addresses:
 for port in [18080,18081,18082]:server(stack,'target',address,port)
 before={a:[request('client',a,p) for p in [18080,18081,18082]] for a in addresses}
 assert all(v['ok'] for values in before.values() for v in values)
 nft('target','''table inet gate {
 chain input { type filter hook input priority 0; policy drop;
 iifname "lo" accept
 ct state established,related accept
 meta l4proto ipv6-icmp accept
 ip protocol icmp accept
 ip saddr 192.0.2.1 tcp dport 18080 counter accept comment "allow4"
 ip6 saddr 2001:db8:1::1 tcp dport 18080 counter accept comment "allow6"
 tcp dport 18081 counter reject with tcp reset comment "reject"
 tcp dport 18082 counter drop comment "drop"
 }
}
''')
 after={a:[request('client',a,p) for p in [18080,18081,18082]] for a in addresses}
 for values in after.values():
 assert values[0]['ok'] and not values[1]['ok'] and values[1]['errno']==111
 assert not values[2]['ok'] and values[2]['type']=='TimeoutError'
 first=counters('target');assert all(first[n]>0 for n in ['allow4','allow6','reject','drop'])
 nft('target','''table inet later {
 chain input { type filter hook input priority 10; policy accept;
 tcp dport 18080 counter drop comment "later_drop"
 }
}
''')
 overridden=request('client','192.0.2.2');assert not overridden['ok'] and overridden['type']=='TimeoutError'
 later=counters('target');assert later['allow4']>first['allow4'] and later['later_drop']>0
 nft('target','delete table inet later')
 recovered=request('client','192.0.2.2');assert recovered['ok']
 print(json.dumps({'before_all_ports_healthy':True,'with_rules':after,'first_counters':first,
 'later_chain_overrides_accept':overridden,'later_counters':later,'later_chain_removed':recovered}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The target starts real HTTP listeners on ports 18080, 18081, and 18082 for both address families. Before filtering, all six requests succeed. This baseline matters: later failure cannot be explained simply by a missing listener or an unconfigured address family. The fixture then installs an inet-family input chain with policy drop, preserving loopback, established traffic, and the selected ICMP handling.

Explicit source-address rules allow destination port 18080 for each family. Port 18081 is rejected with a TCP reset, while 18082 is dropped silently. Both IPv4 and IPv6 probes match the intended result: HTTP 200, ConnectionRefusedError with errno 111, and TimeoutError respectively. The timeout is the fixture’s client deadline, not a promise that every application’s waiting period is identical.

Rule counters confirm packets traversed the allowed, rejected, and dropped branches. A rejected connection and a timed-out one both fail, but their observed failure semantics differ. Those counters supplement the client result; neither configuration text nor a counter alone proves that the application exchanged the expected response. Here, successful requests also record the returned service identity and assert the status.

The script adds another input base chain at priority 10, after the original priority-zero chain. It drops port 18080. A new IPv4 request now times out, while both the earlier allow counter and the later drop counter increase. Removing only the later chain restores HTTP success. This demonstrates the interaction through real packets instead of assuming the first visible accept grants final passage.

Review the effective policy with representative traffic

Keep intended access and generated rules together in a reviewable configuration workflow. Check syntax before applying a change, then inspect the effective rules and run both permitted and denied probes. Established-state handling can preserve existing sessions while new connections behave differently, so include fresh connections when testing an access-policy update. The exercise deliberately creates a new client connection for each comparison.

Define egress policy according to the workload’s actual dependencies and operational requirements. It is a separate decision from inbound listening, not a universal list inferred from open server ports. DNS, destination changes, related control traffic, and forwarded connections need the appropriate context. This laboratory tests target input behavior and does not claim to validate production egress or every container-runtime forwarding rule.

When a permitted service fails, correlate the client error with family, source and destination, namespace, hook, matching counters, and later chains. Confirm the listener separately, and use packet evidence where the path remains unclear. A concise policy becomes dependable when its effective behavior agrees with those checks, including the specific ways denied requests are expected to fail.

Sources

nftables manual, families, hooks, state matching, counters and verdicts, checked 2026-09-12.
nftables chain configuration, base-chain priorities and later chains overriding an accept, checked 2026-09-12.
RFC 4890 ICMPv6 filtering, ICMPv6 requirements that matter to IPv6 communication, checked 2026-09-12.

Firewall · XB Field Notes

A firewall policy must match the packet path, family, and chain order

When it breaks

Check it quickly

Review the effective policy with representative traffic

Further reading

Sources