Nftables Firewall Basics on Linux (vs iptables)

UFW, firewalld and CSF are all front ends to the same kernel packet filter. Knowing nftables, its modern interface (and iptables, the older one) helps you read what those tools generate, debug odd blocks and write precise rules when a front end is not enough.

Before you start

Root access and provider console access: a firewall mistake can cut off SSH.
Pick one manager. Do not mix hand-written nftables rules with UFW, firewalld, CSF or Docker-managed rules unless you understand how they interact.
Install the tools if missing: apt install nftables or dnf install nftables.

How the Linux firewall is organised

Tables group chains by address family: ip, ip6, or inet for both.
Chains hook into the packet path: input (to this server), forward (routed through it, e.g. Docker or VPN), output (from it).
Rules match packets and give a verdict: accept, drop or reject.
A chain's policy is the default verdict for packets no rule matched.

A minimal web server ruleset

Write /etc/nftables.conf:

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state established,related accept
    ct state invalid drop
    iif lo accept

    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    tcp dport 22 ct state new limit rate 10/minute accept
    tcp dport { 80, 443 } accept
    udp dport 443 accept
  }

  chain forward {
    type filter hook forward priority 0; policy drop;
  }

  chain output {
    type filter hook output priority 0; policy accept;
  }
}

ct state established,related accept lets replies to existing connections through: the heart of a stateful firewall.
Loopback and ICMP are allowed (ICMPv6 is required for IPv6 to work).
New SSH connections are rate-limited; web ports are open; everything else is dropped by the policy.

Apply it safely

Check syntax first:

nft -c -f /etc/nftables.conf

Protect yourself against lockout with a timed rollback: in a second session, schedule a flush, then apply:

(sleep 120 && nft flush ruleset) &

nft -f /etc/nftables.conf

If you can still open a new SSH session, cancel the rollback (kill %1 in that shell). Then enable the ruleset at boot:

systemctl enable --now nftables

Inspect and change rules

Show everything: nft list ruleset
Show with rule handles: nft -a list chain inet filter input
Add a rule live: nft add rule inet filter input tcp dport 3306 ip saddr 10.0.0.5 accept
Delete by handle: nft delete rule inet filter input handle 12

Live changes are lost on reboot unless you also put them in /etc/nftables.conf.

Block IPs with a set

nft add set inet filter blocklist '{ type ipv4_addr; flags interval; }'

nft insert rule inet filter input ip saddr @blocklist drop

nft add element inet filter blocklist '{ 203.0.113.0/24 }'

Sets are fast even with thousands of entries.

iptables equivalents

iptables	nftables
`iptables -L -n -v`	`nft list ruleset`
`iptables -A INPUT -p tcp --dport 443 -j ACCEPT`	`nft add rule inet filter input tcp dport 443 accept`
`iptables -I INPUT -s 1.2.3.4 -j DROP`	`nft insert rule inet filter input ip saddr 1.2.3.4 drop`
`iptables-save`	`nft list ruleset > file`

On modern distros, the iptables command is often iptables-nft, a compatibility layer writing nftables rules. iptables-translate converts a rule for you.

Troubleshooting

Locked out: use the provider console and run nft flush ruleset.
Rules vanish after reboot: the nftables service is not enabled, or another tool (firewalld, UFW) overwrites them.
Docker containers lose network: flushing the ruleset removes Docker's rules. Restart Docker after loading your rules, or avoid flush ruleset and manage only your own table.
Packet counters: add counter to a rule to see whether it matches traffic.

nftables FAQ

Should I use nftables directly or a front end?

For most servers a front end (UFW, firewalld, CSF on cPanel) is simpler and less error-prone. Use raw nftables when you need precise control.

Is iptables obsolete?

The legacy iptables backend is being phased out in favour of nftables, but iptables syntax still works through the nft compatibility layer.

Does nftables protect against DDoS?

It can rate-limit and drop floods that reach the server, but large attacks need upstream filtering by the network provider.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket