Securing the Host Itself

In this lesson, you will learn how to design nftables input-chain policies that harden the Linux kernel by strictly controlling the attack surface exposed to remote actors.

When we talk about securing the host itself via the kernel stack, we are moving beyond simple port filtering. We are designing a "Default Deny" posture that treats every packet as a potential exploit attempt before it even reaches a listening daemon.

The Default Deny Foundation

The most effective way to harden a host is to ensure the input chain policy is set to drop. This forces the kernel to ignore any traffic not explicitly authorized. By handling this at the netfilter hook level, we discard malicious payloads before the kernel allocates resources for complex protocol processing.

Strategic Input Hardening

Beyond dropping traffic, hardening the input chain involves mitigating common network-layer attacks. Consider this snippet for a robust base policy:

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        # Accept loopback for local services
        iif "lo" accept

        # Accept established/related to keep existing sessions alive
        ct state established,related accept

        # Drop invalid packets (prevents state confusion attacks)
        ct state invalid drop

        # Rate limit new SSH connections to thwart brute force
        tcp dport 22 ct state new limit rate 3/minute burst 5 packets accept
    }
}

Why This Hardens the Kernel

1. Early Discard: By explicitly dropping invalid packets (those failing checksums or sequence numbers), you prevent the kernel’s connection tracking (conntrack) table from being flooded with malicious, non-routable traffic.
2. Stateful Integrity: The ct state established,related rule is your primary defense. It ensures that the kernel only processes packets belonging to traffic flows initiated by the host itself.
3. Resource Exhaustion Prevention: By applying limit rates to new connection attempts (like SSH), you prevent remote attackers from triggering high-intensity kernel interrupts that lead to local CPU exhaustion.

By combining a strict drop policy with stateful validation, you ensure the kernel remains a gatekeeper rather than a passive observer, forcing remote entities to conform to a narrow, strictly defined communication profile.

Key Takeaway: A hardened host uses a "Default Deny" input policy combined with stateful validation to ensure only legitimate, well-formed traffic reaches the kernel's internal services.