// Module included in the following assemblies:
//
// * installing/install_config/configuring-firewall.adoc

:_mod-docs-content-type: CONCEPT
[id="commatrix-restricting-ingress-traffic_{context}"]
= Ingress traffic configuration with the commatrix plugin

[role="_abstract"]
You can use the `commatrix` plugin to generate `nftables` rules that configure the firewall on cluster nodes to permit only the ingress traffic defined in the communication matrix.

`nftables` is the packet filtering framework in the Linux kernel that replaces `iptables`.
{product-title} cluster nodes running {op-system-first} use `nftables` for packet filtering.
The `commatrix` plugin generates `nftables` rules and packages them as `MachineConfig` resources that the Machine Config Operator applies to your nodes.

When you generate firewall rules with the `commatrix` plugin in Butane format, the plugin also generates a `NodeDisruptionPolicy` patch.
This patch enables the Machine Config Operator to apply `nftables` rule updates without triggering a full node reboot, minimizing disruption to running workloads.

[IMPORTANT]
====
When operators or components are installed, enabled, uninstalled, or disabled, you must regenerate the firewall rules to reflect the new configuration. Failure to regenerate and apply firewall rules in this scenario might have the following consequences:

* Unnecessary ports might remain open, which increases the attack surface of your cluster.

* Services might fail to function correctly if required ports remain blocked by outdated firewall rules.
====
