Linux firewall with IP reputation + NetFlow monitoring

A modern Linux firewall is more than iptables with static rules.

Essential components

nftables / iptables ruleset
GeoIP filtering
IP reputation lists (CrowdSec, AbuseIPDB, Spamhaus, Tor)
fail2ban
Rate limiting
Port knocking

Visibility with NetFlow / sFlow / IPFIX

Top talkers, abnormal connections, exfiltration patterns, ongoing attacks, compliance reporting.

What we deliver

Hardened firewall, automatic blocklist updates, Grafana dashboard, Telegram/email alerting.

Example: ruleset + NetFlow

Reputation-set blocking and NetFlow export to a collector:

# nftables: default drop + GeoIP set + export NetFlow
nft add rule inet filter input ip saddr @blocklist drop
# NetFlow catre colector (softflowd -> nfdump/ntopng):
sudo apt -y install softflowd
sudo softflowd -i eth0 -n 10.0.0.50:2055

nftables: loading a blocklist

This is how you load a list of IPs from a file into an nftables set and apply it:

# 1. tabel + set de tip interval (accepta IP-uri si CIDR)
nft add table inet filter
nft add set inet filter blocklist '{ type ipv4_addr; flags interval; }'

# 2. incarci lista dintr-un fisier (un IP/CIDR pe linie: /etc/nft/blocklist.txt)
while read ip; do [ -n "$ip" ] && nft add element inet filter blocklist "{ $ip }"; done < /etc/nft/blocklist.txt

# 3. regula care pica orice sursa din set + verificare
nft add rule inet filter input ip saddr @blocklist drop
nft list set inet filter blocklist

Auto-refresh from a feed (cron)

You refresh the set daily from a reputation feed (e.g. Spamhaus DROP):

cat >/usr/local/bin/nft-refresh.sh <<'EOF'
#!/bin/bash
nft flush set inet filter blocklist
curl -s https://www.spamhaus.org/drop/drop.txt \
  | grep -oE '^[0-9.]+/[0-9]+' \
  | while read c; do nft add element inet filter blocklist "{ $c }"; done
EOF
chmod +x /usr/local/bin/nft-refresh.sh
echo '0 4 * * * root /usr/local/bin/nft-refresh.sh' > /etc/cron.d/nft-refresh

NetFlow analysis: top talkers and suspicious flows

With softflowd exporting and nfdump collecting, you see who uses the bandwidth and what is abnormal:

# colectorul primeste NetFlow-ul exportat de softflowd
nfcapd -w -D -l /var/cache/nfdump -p 2055
# top 10 consumatori de banda
nfdump -R /var/cache/nfdump -s ip/bytes -n 10
# conexiuni suspecte (porturi tipice de C2/backdoor)
nfdump -R /var/cache/nfdump 'dst port 4444 or dst port 6667'

Basic anti-DDoS protection

You rate-limit new connections per port and handle SYN floods with conntrack:

# max 25 conexiuni noi/sec pe 443, restul drop
nft add rule inet filter input tcp dport 443 ct state new \
  limit rate 25/second burst 50 packets accept
nft add rule inet filter input tcp dport 443 ct state new drop
# throttling pe IP (o singura sursa nu poate inunda)
nft add rule inet filter input ct state new \
  meter flood '{ ip saddr limit rate 50/second }' accept

Live visibility + port knocking

You watch in real time what gets blocked and hide SSH behind a knock sequence:

nft monitor trace            # urmaresti pachetele live
conntrack -L | wc -l         # cate conexiuni active
# port knocking (knockd) — SSH invizibil la scanari
apt -y install knockd
# /etc/knockd.conf: openSSH seq 7000,8000,9000 -> deschide 22 pt IP-ul care 'bate'
systemctl enable --now knockd