nftables is the packet-filtering framework built into the Linux kernel since version 3.13, and the official successor to iptables, ip6tables, arptables and ebtables. It replaces those four separate utilities with a single nft command-line tool and a network-specific virtual machine that runs inside the kernel: nft compiles your ruleset into VM bytecode in netlink format and pushes it through the nftables Netlink API, decompiling it back to readable rules when you list the ruleset.

Key Features

• One unified syntax — a single rule language covers IPv4, IPv6, ARP, bridge and the dual-stack inet family, doing away with the inconsistencies between the xtables utilities.
• In-kernel virtual machine — the ruleset is compiled to bytecode and executed by the kernel VM, so nft behaves as both compiler and decompiler.
• Sets, maps and concatenations — match lists of addresses, ports or interfaces, or concatenated tuples of them, in one rule instead of long linear chains, cutting the number of rule inspections per packet to a minimum.
• Atomic ruleset updates — load a complete ruleset in a single transaction with nft -f, so the firewall is never left half-applied; nft -c validates a ruleset file without loading it.
• Per-rule counters and logging — count packets and bytes on individual rules, emit rate-limited log messages, and reuse the existing netfilter connection-tracking, NAT and userspace-queueing subsystems.
• Native JSON — libnftables and nft -j expose the entire ruleset as JSON, making automated generation, diffing and tooling integrations straightforward.
• Smaller kernel footprint — the intelligence lives in the userspace tool, so new matching features can be delivered by upgrading a package rather than the kernel.
• iptables compatibility layer — the iptables-nft shim runs classic iptables/ip6tables rules over nftables, which makes migrating an existing firewall gradual rather than a rewrite.

Why Use nftables?

iptables required one binary per protocol family and one table per purpose, and each chain was walked linearly until a rule matched — fine for a handful of rules, poor on a busy server or router. nftables keeps the same Netfilter hooks and connection-tracking state, but gives you a single tool, a consistent grammar and proper data structures: a set of 5,000 blocked networks is one @blacklist lookup instead of 5,000 rules. It is also what the rest of the Linux world now builds on — Debian/Ubuntu’s nftables service, firewalld, ufw, Docker, Podman and libvirt all generate nftables rules, so learning nft is learning how modern Linux firewalling actually works underneath.

Use Cases

• Host firewalls on servers and desktops — a default-drop input policy with explicit allowances for SSH, HTTP/S and ICMP.
• Routers, NAT gateways and VPN endpoints — masquerading, port forwarding and forwarding policies in the inet family.
• Container and VM hosts — per-network-namespace and per-bridge filtering, since each netns carries its own ruleset.
• Traffic accounting — per-rule packet/byte counters plus named sets for blocklists of abuse or country ranges.
• Infrastructure as code — generate, validate and diff rulesets as JSON from Ansible, Terraform or your own scripts.

Related tools

• firewalld — zone-based firewall manager that drives nftables on modern distributions.
• ufw — the simple, human-friendly front end to Linux firewalling.
• Fail2ban — bans abusive hosts by inserting firewall rules automatically.
• CrowdSec — collaborative, behaviour-based IP blocking for servers and edge appliances.

Browse more free and open source tools in the directory, or see the Security & Privacy category for related tools.

Platform

Linux (kernel 3.13 or newer; userspace tool packaged by all major distributions)

Licence

GPL-2.0 — GNU General Public License version 2

Website

netfilter.org/projects/nftables · wiki.nftables.org