Zone Firewall: Default-Deny Policy Proven by Live Traffic

This host is the firewall between three networks: the internet, a DMZ holding the public web server, and the office LAN with the admin workstation. Forwarding is on and nothing filters it, so right now every zone can reach every service, including the web server's admin console from the internet and the office workstation from a DMZ box an attacker might own. All three networks are real network namespaces on this box, so you can test from any side. /root/case/brief.txt has this session's addresses, ports and the security policy.

On the live system, write a default-deny zone policy on the forward path:

1. Publish only HTTPS. The internet reaches the web server on tcp 443 and on nothing else.

2. Admin access from the office only. The admin workstation can SSH to the web server; the internet can't.

3. Contain the DMZ. The web server can't open connections into the office, yet replies to connections the office started still come back. That takes connection tracking, not a rule per direction.

4. Default deny. Whatever the policy doesn't allow is dropped. reject is fine too.

5. Persistence. /etc/nftables.conf holds the policy that boot loads.

Grading never reads your ruleset's text. It opens real connections between the zones, including to ports it picks at random, and then rebuilds the network in scratch namespaces, loads /etc/nftables.conf into it and probes it again. Any ruleset that enforces the policy passes, however you structure the tables and chains and whether you drop or reject.