nftables

What actually changed from iptables

nftables replaces the older, harder-to-read rule syntax with a single unified framework, removes the separate tools that used to exist for IPv4 and IPv6, and evaluates rule sets more efficiently at scale on servers handling heavy traffic.

Where teams still get stuck

A lot of existing tutorials, internal scripts and configuration management modules were written for iptables syntax. Migrating a server with an established iptables rule set to nftables usually means rewriting rules rather than a simple one-line switch.

See how nftables compares with iptables and ufw, with example rules, in our Linux firewall guide.

A minimal server ruleset and how to load it safely

On Debian, rules live in /etc/nftables.conf and are loaded at boot once you run systemctl enable nftables.service, according to the Debian wiki. A small inbound-only ruleset, adapted from the nftables wiki sample for a server, looks like this:

flush ruleset
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state vmap { established : accept, related : accept, invalid : drop }
        iifname lo accept
        icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
        tcp dport { 22, 80, 443 } accept
    }
}

The neighbour discovery line matters: the wiki notes that connectivity breaks over IPv6 without it. The inet family covers IPv4 and IPv6 in one table. Be careful with the first line, because flush ruleset removes all tables, not only yours, so rules created by other software are deleted too.

Check the file before applying it, then load it. Loading with -f replaces the rules atomically, so there is no window with a half-loaded ruleset:

sudo nft -c -f /etc/nftables.conf
sudo nft -f /etc/nftables.conf
sudo nft list ruleset

Migrating from iptables and keeping the ruleset readable

You do not have to rewrite an iptables rule set by hand. The nftables project documents a translation path in its migration guide:

iptables-save > save.txt
iptables-restore-translate -f save.txt > ruleset.nft
nft -f ruleset.nft
nft list ruleset

Read the output before trusting it. The guide notes that translated syntax differs from the original and that where no direct translation exists, the result contains a commented-out rule, so each of those needs a manual decision. It also recommends moving on to native features such as sets and verdict maps once the migration works. For one-off rules, iptables-translate shows the nft equivalent of a single command.

Two habits keep a ruleset maintainable. Use nft -a list ruleset to show rule handles, which are what the delete rule command needs, and keep the whole configuration in one file that you load as a unit instead of adding rules by hand and forgetting them. Without a flush at the top, reloading the same file can leave duplicate rules, as the wiki warns for table-level loads. Finally, do not run nft and legacy iptables tools side by side, a combination the project warns can lead to unexpected results. The rate limiting entry shows a common reason to reach for nft sets.

Related terms: iptables, ufw, Firewall, Rate limiting.