Nftables Cheatsheet

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets. It is the modern replacement for iptables.

Basic Commands

sudo nft list ruleset          # List all current rules
sudo nft flush ruleset         # Delete all rules
sudo nft list tables           # List all tables

Structure (Tables -> Chains -> Rules)

Unlike iptables, nftables does not have predefined tables (like filter, nat). You must create them.

1. Create a Table

sudo nft add table inet filter

(The inet family handles both IPv4 and IPv6)

2. Create Chains

# Add an input chain that drops traffic by default
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
 
# Add an output chain that accepts traffic by default
sudo nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }

3. Add Rules

# Allow localhost (loopback)
sudo nft add rule inet filter input iif lo accept
 
# Allow established/related connections
sudo nft add rule inet filter input ct state established,related accept
 
# Allow SSH (Port 22)
sudo nft add rule inet filter input tcp dport 22 accept
 
# Allow HTTP and HTTPS
sudo nft add rule inet filter input tcp dport { 80, 443 } accept
 
# Drop from specific IP
sudo nft add rule inet filter input ip saddr 192.168.1.100 drop

Saving and Loading Rules

# Save rules to a file
sudo nft list ruleset > /etc/nftables.conf
 
# Load rules from a file
sudo nft -f /etc/nftables.conf
 
# Enable nftables on boot
sudo systemctl enable --now nftables