Linux Networking·8 min read·2026-10-05

Modern nftables Ruleset Design: Sets, Maps, and Stateful Firewalls

Replace slow linear iptables rules with high-performance nftables interval sets, verdict maps, and connection tracking on production Linux.

Netbay Cloud Team

Netbay Engineering

On this page

Production nftables Ruleset Configuration
Loading and Managing Rules Atomicallly
Firewall Rules and Packet Flow Video
Performance Advantages over iptables

For over two decades, iptables served as the standard firewall utility for Linux. However, iptables was fundamentally hindered by linear evaluation: as rulesets expanded to encompass hundreds of blocked IP ranges or port definitions, the kernel evaluated each packet against every single rule sequentially, consuming massive CPU cycles. nftables completely replaces iptables, ip6tables, and arptables with a unified, high-performance packet classification engine.

nftables uses advanced data structures including interval sets and verdict maps. Instead of evaluating 500 separate rules to block malicious subnets, nftables performs an O(1) set lookup in memory. Furthermore, verdict maps allow dynamic branching directly to target chains based on port or protocol in a single clock cycle.

Production nftables Ruleset Configuration

Create an enterprise-grade configuration at /etc/nftables.conf:

ini

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    # Define an interval set for blocked subnets
    set blacklisted_ips {
        type ipv4_addr
        flags interval
        elements = { 198.51.100.0/24, 203.0.113.50 }
    }

    # Define rate-limiting set for SSH protection
    set ssh_meter {
        type ipv4_addr
        flags dynamic
        timeout 1m
    }

    chain input {
        type filter hook input priority 0; policy drop;

        # Accept loopback traffic
        iif "lo" accept

        # Accept established and related connection states
        ct state established,related accept
        ct state invalid drop

        # Immediate drop for blacklisted sources
        ip saddr @blacklisted_ips drop

        # Protect SSH with dynamic rate limiting (max 4 new connections per minute)
        tcp dport 22 ct state new update @ssh_meter { ip saddr limit rate over 4/minute } drop
        tcp dport 22 accept

        # Accept public web traffic via verdict map
        tcp dport { 80, 443 } accept

        # Allow essential ICMP ping types
        icmp type { echo-request, destination-unreachable, time-exceeded } accept
        icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded } accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Loading and Managing Rules Atomicallly

One of nftables greatest advantages is atomic ruleset replacement. When you execute nft -f, the kernel swaps the active memory pointers in a single transaction, preventing race conditions.

bash

# Check syntax without applying
sudo nft -c -f /etc/nftables.conf

# Load the ruleset atomically
sudo nft -f /etc/nftables.conf

# Inspect active rules and packet hit counters
sudo nft list ruleset

# Add an offending IP to the blacklist dynamically without reloading
sudo nft add element inet filter blacklisted_ips { 192.0.2.128 }

Firewall Rules and Packet Flow Video

Review modern firewall concepts and packet traversal in this guide:

Modern Firewall Rules and Packet Inspection

Watch on YouTubeYouTube

Performance Advantages over iptables

Because nftables consolidates IPv4 and IPv6 rules under the inet address family, you maintain a single unified ruleset rather than keeping iptables and ip6tables synchronized. In benchmark evaluations with 5,000 firewall rules, nftables consumes less than 1% CPU overhead during high-bandwidth packet bursts.

Safeguard your cloud instances with modern, high-speed firewalling on Netbay at netbayhosts.in.

Keep reading

Linux Networking

Deploy Linux in under 60 seconds

These guides are written against Ubuntu, Debian, and RHEL-family images — the same ones on NetBay.

Deploy an instance