How To Use nftables on Linux Systems

nftables is a Linux packet classification framework that replaces iptables and related tools. It offers performance improvements, unified syntax, and better maintainability. This guide covers installation, configuration, and practical usage.

What Is nftables

nftables provides packet filtering, network address translation (NAT), and traffic classification. The Linux kernel includes nftables starting from version 3.13. Major distributions now ship nftables as the default firewall framework.

The framework uses a hierarchy of tables, chains, and rules. Tables contain chains. Chains contain rules that match and act on packets.

The nft command-line tool manages all nftables operations. It replaces separate utilities like iptables-save and ip6tables.

nftables vs iptables

nftables introduces several changes from iptables. Understanding these differences helps with migration and configuration.

Feature	iptables	nftables
Tables and chains	Predefined tables and chains	No predefined structures
Actions per rule	Single action	Multiple actions
IPv4 and IPv6	Separate tools required	Unified inet family
Rule updates	Replace entire ruleset	Atomic transactions
Debugging	Limited options	Built-in tracing via nftrace

nftables uses a dynamic linked list for rulesets. This improves maintainability compared to the monolithic approach in iptables.

How to Install nftables

Recent distributions include nftables by default. Debian 10, Ubuntu 20.10, CentOS 8, and Fedora 32 ship with nftables pre-installed.

Prerequisites

Root or sudo access is required for installation and configuration. Verify your kernel version supports nftables:

$ uname -r

Kernels version 3.13 and later include nftables support.

Installation Steps

Install nftables on Debian and Ubuntu:

# apt install nftables

Install on RHEL, CentOS, and Fedora:

# dnf install nftables

Enable and start the systemd service:

# systemctl enable nftables
# systemctl start nftables

Verify the service status:

# systemctl status nftables

How to Use nftables

nftables operations involve creating tables, adding chains, and defining rules. Each component serves a specific purpose in packet processing.

Tables

Tables act as containers for chains. Each table belongs to a single address family that determines which packet types it processes.

Family	Description
ip	IPv4 packets (default)
ip6	IPv6 packets
inet	Both IPv4 and IPv6
arp	ARP packets
bridge	Bridge traffic
netdev	Ingress packets

Create a table handling both IP protocol versions:

# nft add table inet my_table

List existing tables:

# nft list tables

Delete a table:

# nft delete table inet my_table

Flush all rules from a table:

# nft flush table inet my_table

Chains

Chains filter packets within tables. Base chains connect to netfilter hooks and receive packets from the network stack. Regular chains serve as jump targets for organization.

Create a base chain for incoming packets:

# nft add chain inet my_table input '{ type filter hook input priority 0; policy accept; }'

The hook determines when packets reach the chain. Common hooks include input, output, forward, prerouting, and postrouting.

Create a regular chain:

# nft add chain inet my_table custom_chain

Delete a chain:

# nft delete chain inet my_table input

Rules

Rules match packets and execute actions. Each rule contains expressions for matching criteria and statements for actions.

Add a rule permitting SSH traffic:

# nft add rule inet my_table input tcp dport 22 accept

Add a rule with packet counting:

# nft add rule inet my_table input tcp dport 443 counter accept

Insert a rule at a specific position:

# nft insert rule inet my_table input position 2 tcp dport 80 accept

List rules with handles for management:

# nft -a list table inet my_table

Delete a rule by handle:

# nft delete rule inet my_table input handle 5

Network Address Translation Setup

nftables supports masquerading and destination NAT. Create a NAT table and postrouting chain for source address translation.

Enable IP forwarding:

# echo 1 > /proc/sys/net/ipv4/ip_forward

Create a NAT table with masquerading:

# nft add table inet nat
# nft add chain inet nat postrouting '{ type nat hook postrouting priority srcnat; }'
# nft add rule inet nat postrouting oifname "eth0" masquerade

Configure destination NAT for port forwarding:

# nft add chain inet nat prerouting '{ type nat hook prerouting priority dstnat; }'
# nft add rule inet nat prerouting tcp dport 8080 dnat to 192.168.1.100:80

Migrating from iptables

Translation tools convert existing iptables rules to nftables format. Export current rules with iptables-save:

# iptables-save > /root/iptables.rules

Translate the exported rules:

# iptables-restore-translate -f /root/iptables.rules > /etc/nftables/converted.nft

Import the converted ruleset:

# nft -f /etc/nftables/converted.nft

Saving and Restoring Rules

Export the current ruleset to a file:

# nft list ruleset > /etc/nftables/backup.nft

Restore rules from a backup:

# nft -f /etc/nftables/backup.nft

Clear all existing rules:

# nft flush ruleset

Configure persistent rules by editing /etc/nftables.conf. The nftables service loads this file at boot.