Computer Networking Cheatsheet

Firewalls and ACLs

Use this Computer Networking reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

Stateless vs stateful

	Stateless (packet filter · ACL)	Stateful
Decides on	one packet's headers	the packet plus connection state
Return traffic	needs its own explicit rule	allowed automatically
Memory	none per flow	a table entry per flow
Handles fragments	poorly, later fragments lack ports	reassembles or tracks
Asymmetric routing	tolerates it	breaks, the reply looks unsolicited
Examples	router ACLs, AWS network ACLs	iptables/nftables conntrack, AWS security groups

The practical difference: on a stateless filter you must permit established traffic yourself (in IPv4 that historically meant matching ACK on high ports), while a stateful firewall needs only "allow outbound, allow the replies".

Connection tracking states

Linux conntrack classifies every packet, and the whole modern ruleset is built on it.

ctstate	Meaning
`NEW`	first packet of a flow, a TCP SYN or a fresh UDP datagram
`ESTABLISHED`	belongs to a flow already seen in both directions
`RELATED`	a new flow spawned by a tracked one, FTP data, ICMP errors
`INVALID`	unmatchable, out-of-window, or a malformed packet
`UNTRACKED`	deliberately exempted with `NOTRACK`

UDP has no handshake, so "established" for UDP simply means the firewall has seen traffic both ways within the timeout.

nftables, the current Linux default

nft list ruleset                      # everything, the one command to read state
nft -f /etc/nftables.conf             # load atomically

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    iif lo accept
    ct state established,related accept
    ct state invalid drop
    ip protocol icmp icmp type { echo-request, destination-unreachable,
                                 time-exceeded } accept
    ip6 nexthdr icmpv6 accept
    tcp dport { 22, 80, 443 } ct state new accept
    ip saddr 10.0.0.0/8 tcp dport 5432 accept
    limit rate 5/minute log prefix "nft-drop "
  }
  chain forward { type filter hook forward priority 0; policy drop; }
  chain output  { type filter hook output  priority 0; policy accept; }
}

table inet covers IPv4 and IPv6 in one place, which is the main reason to prefer nftables over the two separate iptables binaries. Hooks in order: prerouting → input for local traffic, prerouting → forward → postrouting for routed traffic, and output → postrouting for locally generated traffic.

iptables equivalents

iptables -L -n -v --line-numbers        # read, with counters
iptables -P INPUT DROP                  # default policy
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 5432 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -I INPUT 3 -s 203.0.113.7 -j DROP    # insert at position 3
iptables -D INPUT 3                            # delete rule 3
iptables-save > /etc/iptables/rules.v4
iptables-restore < /etc/iptables/rules.v4

Target	Effect on the sender
`ACCEPT`	passes
`DROP`	silence, the client hangs until timeout
`REJECT`	immediate error, ICMP unreachable or TCP RST
`LOG`	writes to the kernel log and keeps evaluating
`RETURN`	leave this chain, resume the caller

Rules are evaluated top to bottom and the first match wins, so a broad ACCEPT above a specific DROP makes the drop dead code. -A appends, which often lands the rule after a catch-all, and -I inserts at the top.

DROP vs REJECT matters operationally: dropped ports make port scans slow and ambiguous, rejected ports fail fast and are kinder to your own clients.

Cloud and appliance ACLs

	AWS security group	AWS network ACL
Attaches to	ENI · instance	subnet
State	stateful	stateless
Rules	allow only	allow and deny
Evaluation	all rules, any match allows	numbered, lowest match wins
Return traffic	automatic	needs an explicit rule, on the ephemeral range

The classic cloud outage: a network ACL that permits inbound 443 but not outbound 1024-65535, so requests arrive and responses never leave.

On Cisco-style ACLs remember there is an implicit deny any at the end, and that named extended ACLs let you resequence, while numbered ones append only.

Simple frontends and host firewalls

# ufw, Debian and Ubuntu
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow from 10.0.0.0/8 to any port 5432 proto tcp
ufw limit ssh                     # rate limit brute force
ufw status verbose

# firewalld, RHEL and Fedora
firewall-cmd --get-active-zones
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --zone=public --add-port=8080/tcp --permanent
firewall-cmd --zone=public --add-rich-rule=\
'rule family=ipv4 source address=10.0.0.0/8 port port=5432 protocol=tcp accept' \
--permanent
firewall-cmd --reload
firewall-cmd --list-all

Verifying rules actually do what you think

nft list ruleset | grep -n counter    # add `counter` to rules, then watch them
iptables -L INPUT -n -v              # pkts/bytes column per rule
conntrack -E -e NEW                  # watch flows being created live
nc -vz host 443                      # from outside: open, refused, or timeout
nmap -Pn -p 22,80,443 --reason host  # open vs closed vs filtered
tcpdump -ni eth0 'tcp port 443 and tcp[tcpflags] & tcp-syn != 0'
journalctl -k -g 'nft-drop'          # your LOG prefix

Interpretation table for a probe from outside:

Result	Means
connects	rule permits, service listening
`Connection refused` (RST)	reached the host, nothing listening, or REJECT
hangs then times out	a DROP rule or a routing black hole
`No route to host` (ICMP 3/1)	ARP or routing failure, not a firewall

Always audit both directions and both address families. An IPv4-only ruleset on a dual-stack host leaves every service wide open over IPv6.