Testing Firewall Rulesets

In this lesson, you will learn how to use shadow testing to validate new firewall rulesets against live traffic without risking connectivity outages or production downtime.

The Concept of Shadow Testing

When managing production firewalls, applying a new ruleset is often a "sink or swim" scenario. If your logic contains a subtle flaw—like a misconfigured port or an inverted mask—you risk dropping legitimate traffic or locking yourself out of the host. Shadow testing (or "dry-run" monitoring) allows you to mirror production traffic through a parallel ruleset that records what would have happened without actually enforcing those actions.

Implementation via Netfilter/NFTables

The safest way to perform shadow testing is to create a "shadow chain" that duplicates the logic of your new rules but uses log or meta mark instead of drop or accept. By tagging packets that match your new, unproven rules, you can observe their behavior in the system logs or via packet counters before ever switching them to active enforcement.

Consider this workflow:

1. Define the Shadow Chain: Create a chain that mirrors your intended changes.
2. Log, Don't Block: Use the log prefix action to capture matches.
3. Audit Results: Compare the hits in your shadow chain against your existing production traffic logs.

# Create a shadow chain
nft add chain inet filter shadow_test

# Add your new rules to the shadow chain, logging instead of dropping
nft add rule inet filter shadow_test tcp dport 8080 log prefix "SHADOW_MATCH: "

# Divert a copy of incoming traffic to this chain for testing
nft insert rule inet filter input tcp dport 8080 jump shadow_test

By keeping the rules in a jump target that performs logging, you ensure the production traffic continues to be processed by your original, trusted rules. If the SHADOW_MATCH logs show that the new rules are behaving as expected—and only matching the traffic you intend—you can confidently migrate them into the main processing path. This eliminates the "guesswork" involved in rule deployment and provides an audit trail of how the new logic handles real-world packets.

Key Takeaway: Use shadow testing by directing live traffic through non-enforcing, logging-only chains to verify rule logic before applying it to production traffic.