iptables vs nftables: Server Firewall Basics

The Linux firewall has a long and storied history. For nearly two decades, iptables was the standard tool for packet filtering. Around 2014, the nftables framework replaced it as the new packet filtering subsystem, and modern distributions now ship nftables as standard. If you have only ever used iptables, the transition feels jarring. The syntax looks different, the tables have changed, and the chains work differently. But underneath, the concepts are familiar, and learning nftables gives you a cleaner, more powerful firewall.

Why the Transition Happened

iptables grew organically over many years, layering features on top of a fixed design. The result was four separate tables (filter, nat, mangle, raw) with hardcoded priorities. Extensions were separate modules with inconsistent syntax. nftables consolidates everything into a single in-kernel virtual machine with a unified syntax. Rules are evaluated differently, and chains can be created and named freely.

The practical benefit is a unified, scriptable configuration. With nftables you can write one ruleset file that configures every table and chain, include other files, and use variables. The syntax is more regular, which makes it easier to learn and debug.

Reading an nftables Ruleset

The nft command manages the ruleset. To list current rules, nft list ruleset. A typical ruleset looks like the following.

nft list ruleset

The ruleset blocks look different from iptables. Instead of INPUT, OUTPUT, and FORWARD chains with a fixed order, an nftables ruleset defines tables, then chains within tables, then rules within chains. Each rule has a positional set of primitives. The kernel walks the chain from top to bottom and jumps or accepts packets based on rule verdicts.

Here is a minimal nftables ruleset that allows SSH and drops everything else on input.

table inet filter {
  chain input {
    type filter hook input priority filter; policy drop;
    ct state established,related accept
    iifname "lo" accept
    tcp dport 22 accept
    tcp dport 443 accept
  }
}

The inet family handles both IPv4 and IPv6 rules in a single table, which is a major improvement over iptables where you had to duplicate rules for ip6tables. The hook parameter attaches the chain to a well-known packet processing point. Policy drop means anything not matched is dropped.

Writing Rules: iptables and nftables Compared

The same rule looks very different in the two tools. Consider allowing port 80 inbound.

# iptables way
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# nftables way
nft add rule inet filter input tcp dport 80 accept

The nftables version reads almost like English. The inet filter input part selects the table and chain. The tcp dport 80 qualify the match. The accept keyword is the verdict that ends processing for the packet. The approach is additive: you build a rule from a base and add match and verdict primitives.

To delete a rule in nftables, you first need its handle. Use nft -a list ruleset to see handles, then delete by handle.

nft -a list ruleset
nft delete rule inet filter input handle 3

This is different from iptables where you could specify a rule by its description. The handle-based approach is precise but requires listing first.

Working with nftables Configuration Files

nftables rulesets are usually defined in files under /etc/nftables.conf and loaded at boot. The advantage is that the file is the source of truth, not a series of incremental commands appended over weeks.

nft list ruleset > /etc/nftables.conf
nft -f /etc/nftables.conf
nft flush ruleset

The nft -f command loads a ruleset file. nft flush ruleset removes everything currently active, giving you a clean slate before loading new rules. This atomicity is powerful: you can define an entire firewall in one file, review it, and apply it in a single operation.

nftables and Containers

Containers and VPS networking complicate firewalls because traffic may traverse multiple hook points. When Docker or other runtimes are involved, nftables and iptables can coexist, but you must be careful. Docker wires its rules into the iptables compatibility layer. If you switch your host entirely to nftables with the iptables-nft compatibility package, Docker's rules keep working through that translation layer.

iptables-nft -L
nft list tables

It is best on a server to have exactly one firewall system managing rules. Pick nftables for your own rules, and let the compatibility layer handle tools like Docker that still talk iptables. Check nft list tables regularly to make sure you understand what is active.

Security Principles

Regardless of which tool you use, the principles stay the same. Enforce a default-drop policy on input and forward chains for incoming traffic. Explicitly allow only the services you run. Keep your rules minimal and documented. Put your ruleset under version control so changes are reviewable.

A good VPS default policy looks like this: drop everything by default, allow established and related connections so return traffic works, allow the loopback interface, allow your management port, and optionally allow common web ports.

You can try nftables on a fresh Ubuntu or Debian VPS from Netbay in under 60 seconds at netbayhosts.in.