nftables

nftables is the modern Linux packet filter and the successor to iptables, ip6tables, arptables and ebtables. One tool (nft) and one syntax cover IPv4, IPv6, ARP and bridge traffic, with sets and maps for fast matching. Debian 10+, Ubuntu 20.10+ and RHEL 8+ use it as the kernel backend; the iptables command there is often iptables-nft, a translation layer (IPTables). UFW (uncomplicated firewall) and firewalld can also sit on top.

Documentation: nftables wiki · Quick reference · man nft

Verification: syntax follows the nftables wiki and man nft. No command was executed. A bad ruleset applied over SSH can lock you out: keep a second session open or use the timed rollback below.

See also: IPTables · UFW (uncomplicated firewall) · Docker Networking · Linux · systemd

Concepts #

Unlike iptables there are no built-in tables. You create them.

Inspect #

A Minimal Host Firewall #

/etc/nftables.conf:

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
  set trusted {
    type ipv4_addr
    flags interval
    elements = { 192.168.1.0/24 }
  }

  chain input {
    type filter hook input priority 0; policy drop;

    iif "lo" accept
    ct state established,related accept
    ct state invalid drop

    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    tcp dport 22 ip saddr @trusted accept
    tcp dport { 80, 443 } accept

    counter log prefix "nft-drop: " level warn limit rate 5/minute
  }

  chain forward {
    type filter hook forward priority 0; policy drop;
  }

  chain output {
    type filter hook output priority 0; policy accept;
  }
}

sudo nft -c -f /etc/nftables.conf        # check syntax only
sudo nft -f /etc/nftables.conf           # load
sudo systemctl enable --now nftables     # load at boot (Debian/Ubuntu/RHEL)

Careful: flush ruleset also removes the chains that Docker and libvirt create. Restart Docker after loading or limit the flush to your own table (flush table inet filter). See Docker Networking.

Safe test over SSH:

sudo nft -f /etc/nftables.conf && sleep 60 && echo "kept" || true
# if you got locked out, a scheduled revert helps:
echo 'nft flush ruleset' | sudo at now + 5 minutes

Manage Rules at Runtime #

Matching Cheat Sheet #

Sets and Dynamic Blocklists #

# a set of blocked IPs with timeouts
sudo nft add set inet filter blocklist '{ type ipv4_addr; flags timeout; timeout 1h; }'
sudo nft add rule inet filter input ip saddr @blocklist drop

sudo nft add element inet filter blocklist '{ 203.0.113.9 }'                   # default timeout
sudo nft add element inet filter blocklist '{ 198.51.100.7 timeout 24h }'
sudo nft delete element inet filter blocklist '{ 203.0.113.9 }'
sudo nft list set inet filter blocklist

Put the drop rule before your accept rules. Tools like fail2ban and CrowdSec can use nftables sets as the ban backend.

SSH brute-force rate limit using a meter:

tcp dport 22 ct state new meter ssh-limit { ip saddr limit rate 5/minute } accept
tcp dport 22 drop

NAT and Port Forwarding #

table inet nat {
  chain prerouting {
    type nat hook prerouting priority dstnat; policy accept;
    tcp dport 8080 dnat ip to 192.168.1.10:80
  }
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    oifname "eth0" ip saddr 10.0.0.0/24 masquerade
  }
}

Also enable forwarding: sudo sysctl -w net.ipv4.ip_forward=1 (persist in /etc/sysctl.d/99-forward.conf) and allow the traffic in the forward chain:

ip daddr 192.168.1.10 tcp dport 80 ct status dnat accept

Use nat in a separate table (inet nat works for IPv4 and IPv6 on kernel 5.2+).

iptables to nftables #

Do not mix iptables-legacy and nft rules on one host: packets pass both and debugging gets confusing. Pick one.

Notes #

• Counters on a rule (counter) are the quickest debugging tool: list the chain and see which rules match.
• Debian ships the loader unit nftables.service that reads /etc/nftables.conf. RHEL reads /etc/sysconfig/nftables.conf, which includes files under /etc/nftables/.
• firewalld and ufw own their own tables. Editing the live set by hand will be overwritten when they reload.