nftables Basics

1. Introduction

nftables is a framework for packet filtering and classification in the Linux kernel, designed to replace iptables, ip6tables, arptables, and ebtables. It provides a single interface for managing packet filtering rules across different protocols.

2. Key Concepts

3. Installation

To install nftables on a Debian-based system, use the following command:

sudo apt install nftables

For RHEL-based systems, use:

sudo dnf install nftables

After installation, enable and start the service:

sudo systemctl enable nftables
sudo systemctl start nftables

4. Basic Usage

To interact with nftables, use the nft command. Below are the basic commands:

4.1. Creating a Table

nft add table inet filter

4.2. Creating a Chain

nft add chain inet filter input { type filter hook input priority 0; }

4.3. Adding a Rule

nft add rule inet filter input ip saddr 192.168.1.0/24 accept

4.4. Listing Rules

nft list ruleset

5. Examples

5.1. Simple Firewall

nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0; }
nft add rule inet filter input ip saddr 192.168.1.0/24 accept
nft add rule inet filter input drop

5.2. Allow SSH

nft add rule inet filter input tcp dport 22 accept

6. Best Practices

• Regularly review and update your firewall rules.
• Use logging to monitor suspicious activity.
• Always test new rules in a safe environment before deploying.

7. FAQ