nftables
nftables is the Linux kernel's packet filtering and NAT framework that replaces the long-serving iptables. It unifies syntax across IPv4, IPv6, ARP, and bridging, matches rules more efficiently through sets and maps, and supports transactional rule changes. It has shipped in mainline kernels since 3.13 and is the default firewall backend on current distributions.
How it works
The relationship with iptables is often misunderstood as a full replacement: on many systems both coexist, and software like Docker and fail2ban still writes iptables rules through the compatibility layer, which the kernel translates into nftables. When writing native nftables rules, watch for coexistence with those tools. Syntax-wise, the nft command organizes rules into tables, chains, and rules, with named sets for IP lists that can be updated atomically. Migrating from iptables calls for careful rule-by-rule review of the translation, compatibility checks with Docker's chains, and a staged switchover so you don't lock yourself out of a remote server.
Examples
- 1.Configuring baseline inbound rules with nft on a fresh Debian or Ubuntu server
- 2.Translating an iptables-save dump into nftables syntax and reviewing it line by line
- 3.Managing a blocklist as a named set, adding and removing IPs in one command