Lock down a host with nftables
A server accepts connections on every port from anywhere. Write an nftables ruleset that default-drops, allows web to all, and restricts SSH to the admin network, graded by replaying real connection attempts through your rules.
Scenario
web1 currently accepts connections on every port from anywhere: its input chain has a default
accept policy and one careless rule that opens SSH to the world. Tighten it with nftables.
Requirements
- SSH (22): allowed only from the admin subnet
10.0.0.0/24. - HTTP (80) and HTTPS (443): open to everyone.
- Everything else: dropped.
How it's graded
The grader replays connection attempts through your ruleset and checks the verdict:
| from | port | expected |
|------|------|----------|
| 10.0.0.5 (admin) | 22 | accept |
| 203.0.113.9 (internet) | 22 | drop |
| 203.0.113.9 | 80 / 443 | accept |
| 203.0.113.9 | 3306 | drop |
This is real flow evaluation, not a keyword check.
Supported syntax
policy accept|drop;, ip saddr <cidr> tcp dport <port> accept, tcp dport <port> accept,
tcp dport { 80, 443 } accept, udp dport <port> drop. ct state established,related accept is fine
to keep; it matches replies, not new inbound connections.
What "done" looks like
A default-drop input chain that admits web from anywhere and SSH only from the admin subnet.
Teaches: host firewalling and default-deny, the baseline every server hardening guide starts with.
What gets checked
Your solution is verified against each of these:
- SSH (22) is allowed from the admin subnet (10.0.0.0/24)
- SSH is dropped from the public internet
- HTTP (80) and HTTPS (443) are open to everyone
- Everything else (e.g. a stray 3306) is dropped
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.