Just curious. An example in nftables wiki allow related and established connections and then drop invalid connections. Is it necessary?


If you don't explicitly drop invalid connections, then nftables will go through the following rules. If there is no matching rule, it will apply the default policy of the chain (which by default is 'accept').

So it depends on what your following rules and default policy are. But if say, one of your rule is to accept incoming packets to port 22, you really want to drop invalid connections first.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.