nftables Firewall Cheatsheet

nftables

nftables is the modern successor to iptables, default on many newer distros. It uses a single framework with simpler syntax.

Installation

# Debian/Ubuntu
apt-get install nftables
 
# RHEL/CentOS/Rocky (default on RHEL 9+)
yum install nftables
systemctl enable --now nftables
 
# Arch
pacman -S nftables
systemctl enable --now nftables

Basic Commands

# List ruleset
nft list ruleset
 
# Flush rules
nft flush ruleset
 
# List specific table
nft list table inet filter

Ruleset Syntax

# Create table and chain (allow SSH)
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; }
nft add rule inet filter input tcp dport 22 accept
 
# Allow established connections
nft add rule inet filter input ct state established,related accept
 
# Allow loopback
nft add rule inet filter input iif lo accept
 
# Default drop
nft add rule inet filter input drop

Complete nftables Script

#!/usr/bin/nft -f
 
# Flush existing rules
flush ruleset
 
# Create table
table inet filter {
    # Input chain
    chain input {
        type filter hook input priority 0; policy drop;
 
        # Allow loopback
        iif lo accept
 
        # Allow established connections
        ct state established,related accept
 
        # Allow SSH
        tcp dport 22 accept
 
        # Allow HTTP/HTTPS
        tcp dport {80, 443} accept
 
        # Allow ping
        icmp type { echo-request } accept
 
        # Log dropped
        log prefix "nftables-drop: " limit rate 5/minute
    }
 
    # Forward chain
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
 
    # Output chain
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Save & Restore

# Save ruleset
nft list ruleset > /etc/nftables.conf
 
# Restore ruleset
nft -f /etc/nftables.conf
 
# Enable on boot (Debian/Ubuntu)
systemctl enable nftables
systemctl restart nftables

Common Patterns

# Allow specific IP
nft add rule inet filter input ip saddr 192.168.1.100 accept
 
# Block specific IP
nft add rule inet filter input ip saddr 10.0.0.0/8 drop
 
# Rate limit
nft add rule inet filter input tcp dport 22 limit rate 5/minute accept
 
# Port ranges
nft add rule inet filter input tcp dport 8000-8010 accept
 
# NAT (masquerade)
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule ip nat postrouting oif eth0 masquerade
 
# Port forwarding
nft add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
nft add rule ip nat prerouting tcp dport 80 redirect to :8080