Configure Linux system firewall with nftables and security hardening

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
PKG_MGR=""
PKG_INSTALL=""
PKG_UPDATE=""
FIREWALL_SERVICE=""
IPTABLES_SERVICE=""
SSH_PORT="${1:-22}"

# Usage message
usage() {
    echo "Usage: $0 [SSH_PORT]"
    echo "  SSH_PORT: SSH port number (default: 22)"
    exit 1
}

# Logging functions
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function for rollback
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        log_error "Script failed. Attempting cleanup..."
        if [ -f /etc/nftables.conf.backup ]; then
            mv /etc/nftables.conf.backup /etc/nftables.conf 2>/dev/null || true
        fi
        systemctl stop nftables 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Auto-detect distribution
detect_distro() {
    if [ ! -f /etc/os-release ]; then
        log_error "/etc/os-release not found. Cannot detect distribution."
        exit 1
    fi

    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            FIREWALL_SERVICE="ufw"
            IPTABLES_SERVICE="iptables"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_SERVICE="firewalld"
            IPTABLES_SERVICE="iptables"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            FIREWALL_SERVICE="iptables"
            IPTABLES_SERVICE="iptables"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_success "Detected distribution: $PRETTY_NAME"
}

# Validate SSH port
validate_ssh_port() {
    if ! [[ "$SSH_PORT" =~ ^[0-9]+$ ]] || [ "$SSH_PORT" -lt 1 ] || [ "$SSH_PORT" -gt 65535 ]; then
        log_error "Invalid SSH port: $SSH_PORT"
        usage
    fi
}

# Update system and install nftables
install_nftables() {
    echo "[1/6] Updating system and installing nftables..."
    
    log_info "Updating system packages..."
    eval $PKG_UPDATE
    
    log_info "Installing nftables..."
    eval "$PKG_INSTALL nftables"
    
    log_success "nftables installed successfully"
}

# Stop and disable conflicting firewall services
disable_conflicting_services() {
    echo "[2/6] Disabling conflicting firewall services..."
    
    case "$PKG_MGR" in
        apt)
            systemctl stop ufw 2>/dev/null || log_warning "ufw service not running"
            systemctl disable ufw 2>/dev/null || log_warning "ufw service not found"
            ;;
        dnf|yum)
            systemctl stop firewalld 2>/dev/null || log_warning "firewalld service not running"
            systemctl disable firewalld 2>/dev/null || log_warning "firewalld service not found"
            ;;
    esac
    
    systemctl mask iptables 2>/dev/null || log_warning "iptables service not found"
    systemctl mask ip6tables 2>/dev/null || log_warning "ip6tables service not found"
    
    log_success "Conflicting services disabled"
}

# Create nftables configuration
create_nftables_config() {
    echo "[3/6] Creating nftables configuration..."
    
    # Backup existing configuration if it exists
    if [ -f /etc/nftables.conf ]; then
        cp /etc/nftables.conf /etc/nftables.conf.backup
        log_info "Existing configuration backed up"
    fi
    
    cat > /etc/nftables.conf << EOF
#!/usr/sbin/nft -f

# Clear existing rules
flush ruleset

# Define variables for common ports and networks
define SSH_PORT = $SSH_PORT
define HTTP_PORT = 80
define HTTPS_PORT = 443
define TRUSTED_NETS = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }

# Main filter table
table inet filter {
    # Chain for input packets
    chain input {
        type filter hook input priority filter; policy drop;
        
        # Accept loopback traffic
        iif "lo" accept
        
        # Accept established and related connections
        ct state established,related accept
        
        # Drop invalid connections
        ct state invalid drop
        
        # Accept ICMP (ping) with rate limiting
        ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } limit rate 5/second accept
        ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, time-exceeded, nd-neighbor-solicit, nd-neighbor-advert } limit rate 5/second accept
        
        # SSH with rate limiting
        tcp dport \$SSH_PORT ct state new limit rate 3/minute burst 3 packets accept
        
        # HTTP and HTTPS
        tcp dport { \$HTTP_PORT, \$HTTPS_PORT } ct state new accept
        
        # Log dropped packets (rate limited)
        limit rate 10/minute burst 5 packets log prefix "nftables-dropped: "
        
        # Default drop (implicit due to policy)
    }
    
    # Chain for forward packets (for routers/gateways)
    chain forward {
        type filter hook forward priority filter; policy drop;
        
        # Accept established and related connections
        ct state established,related accept
        
        # Log dropped forwards
        limit rate 5/minute burst 3 packets log prefix "nftables-forward-drop: "
    }
    
    # Chain for output packets
    chain output {
        type filter hook output priority filter; policy accept;
        
        # Generally allow all outbound traffic
        # Add restrictions here if needed
    }
}

# NAT table for network address translation
table ip nat {
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
    }
    
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        
        # Example: masquerade outbound traffic (uncomment if needed)
        # oifname "eth0" masquerade
    }
}
EOF

    chmod 644 /etc/nftables.conf
    chown root:root /etc/nftables.conf
    
    log_success "nftables configuration created"
}

# Enable and start nftables service
enable_nftables() {
    echo "[4/6] Enabling and starting nftables service..."
    
    systemctl enable nftables
    systemctl start nftables
    
    log_success "nftables service enabled and started"
}

# Install and configure fail2ban
configure_fail2ban() {
    echo "[5/6] Installing and configuring fail2ban..."
    
    eval "$PKG_INSTALL fail2ban"
    
    # Create fail2ban jail configuration for nftables
    cat > /etc/fail2ban/jail.d/sshd-nftables.conf << EOF
[sshd]
enabled = true
port = $SSH_PORT
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 600
bantime = 3600
backend = systemd
banaction = nftables-multiport
banaction_allports = nftables-allports
EOF

    # Create local configuration
    if [ ! -f /etc/fail2ban/jail.local ]; then
        cat > /etc/fail2ban/jail.local << EOF
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 3
backend = systemd

[sshd]
enabled = true
port = $SSH_PORT
EOF
    fi

    chmod 644 /etc/fail2ban/jail.d/sshd-nftables.conf
    chmod 644 /etc/fail2ban/jail.local
    chown root:root /etc/fail2ban/jail.d/sshd-nftables.conf
    chown root:root /etc/fail2ban/jail.local

    systemctl enable fail2ban
    systemctl restart fail2ban
    
    log_success "fail2ban configured and started"
}

# Verify configuration
verify_setup() {
    echo "[6/6] Verifying configuration..."
    
    # Check if nftables is running
    if systemctl is-active --quiet nftables; then
        log_success "nftables service is active"
    else
        log_error "nftables service is not active"
        return 1
    fi
    
    # Check if fail2ban is running
    if systemctl is-active --quiet fail2ban; then
        log_success "fail2ban service is active"
    else
        log_warning "fail2ban service is not active"
    fi
    
    # Test nftables rules
    if nft list ruleset > /dev/null 2>&1; then
        log_success "nftables rules loaded successfully"
    else
        log_error "Failed to load nftables rules"
        return 1
    fi
    
    # Show current rules summary
    echo
    log_info "Current nftables rules summary:"
    nft list ruleset | grep -E "(chain|policy|accept|drop)" | head -10
    
    echo
    log_success "Firewall configuration completed successfully!"
    log_info "SSH port: $SSH_PORT"
    log_info "Allowed services: SSH, HTTP, HTTPS"
    log_warning "Make sure you can connect via SSH on port $SSH_PORT before closing this session"
}

# Main execution
main() {
    log_info "Starting nftables firewall configuration..."
    
    check_privileges
    detect_distro
    validate_ssh_port
    
    install_nftables
    disable_conflicting_services
    create_nftables_config
    enable_nftables
    configure_fail2ban
    verify_setup
    
    echo
    log_success "nftables firewall setup completed successfully!"
    echo
    echo "Next steps:"
    echo "- Test SSH connectivity on port $SSH_PORT"
    echo "- Review logs: journalctl -u nftables -f"
    echo "- Monitor fail2ban: fail2ban-client status"
    echo "- Customize rules in /etc/nftables.conf as needed"
}

# Run main function
main "$@"