Nftables Cheatsheet

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets. It is the modern replacement for iptables, ip6tables, arptables, and ebtables.

Installation

# Debian / Ubuntu
sudo apt install nftables
 
# RHEL / CentOS / Fedora
sudo dnf install nftables
 
# Arch Linux
sudo pacman -S nftables
 
# Enable nftables service on boot
sudo systemctl enable --now nftables

Basic Commands

sudo nft list ruleset              # List all current rules across all tables
sudo nft flush ruleset             # Delete all rules (clears everything)
sudo nft list tables               # List all tables
sudo nft list table inet filter    # List rules in a specific table

Structure: Tables → Chains → Rules

Unlike iptables, nftables does not have predefined tables. You create your own.

1. Create a Table

# Create a table using the "inet" family (handles both IPv4 and IPv6)
sudo nft add table inet filter

2. Create Chains

# Input chain — drops traffic by default (policy drop)
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
 
# Forward chain — drops forwarded traffic by default
sudo nft add chain inet filter forward { type filter hook forward priority 0 \; policy drop \; }
 
# Output chain — allows outgoing traffic by default
sudo nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }

3. Add Rules

# Allow loopback (localhost)
sudo nft add rule inet filter input iif lo accept
 
# Allow established and related connections
sudo nft add rule inet filter input ct state established,related accept
 
# Allow SSH (port 22)
sudo nft add rule inet filter input tcp dport 22 accept
 
# Allow HTTP and HTTPS
sudo nft add rule inet filter input tcp dport { 80, 443 } accept
 
# Allow ICMP (ping)
sudo nft add rule inet filter input icmp type echo-request accept
 
# Allow from a specific IP
sudo nft add rule inet filter input ip saddr 192.168.1.100 accept
 
# Drop from a specific IP
sudo nft add rule inet filter input ip saddr 10.0.0.5 drop

Deleting Rules

# List rules with handles (handles are unique rule IDs)
sudo nft -a list table inet filter
 
# Delete a rule by its handle number
sudo nft delete rule inet filter input handle 7

Named Sets

Group IPs or ports into reusable sets.

# Create a named set for IP addresses
sudo nft add set inet filter blacklist { type ipv4_addr \; }
 
# Add IPs to the set
sudo nft add element inet filter blacklist { 10.0.0.5, 10.0.0.6, 192.168.1.100 }
 
# Use the set in a rule
sudo nft add rule inet filter input ip saddr @blacklist drop
 
# Delete an element from the set
sudo nft delete element inet filter blacklist { 10.0.0.5 }
 
# List all sets
sudo nft list sets

NAT (Network Address Translation)

# Create a NAT table
sudo nft add table inet nat
 
# Create NAT chains
sudo nft add chain inet nat prerouting { type nat hook prerouting priority -100 \; }
sudo nft add chain inet nat postrouting { type nat hook postrouting priority 100 \; }
 
# Masquerade outgoing traffic (for internet sharing via gateway)
sudo nft add rule inet nat postrouting oifname "eth0" masquerade
 
# Port forwarding: redirect port 8080 to internal server 192.168.1.10:80
sudo nft add rule inet nat prerouting tcp dport 8080 dnat to 192.168.1.10:80

Counters

Track packet and byte counts per rule.

# Add a rule with a counter
sudo nft add rule inet filter input tcp dport 22 counter accept
 
# View counters (shown in nft list output as packets/bytes)
sudo nft list table inet filter

Saving and Loading Rules

# Save current ruleset to a file
sudo nft list ruleset > /etc/nftables.conf
 
# Load rules from a file
sudo nft -f /etc/nftables.conf
 
# Enable nftables service to load rules on boot
sudo systemctl enable nftables

Cheatsheets