nft — netfilter4 firewall management

💬 "nft command"

nft manages the Netfilter4 firewall management Linux kernel's nftables subsystem. It is the successor to iptables.

It unifies iptables, ip6tables, arptables, and ebtables into one. It allows bulk IP management with dynamic sets.

• Concept: It unifies iptables, ip6tables, arptables, and ebtables into one.
• Main feature: It allows bulk IP management with dynamic sets.
• Advantage: No traffic disruption due to atomic rule replacement.
• Usage: Version control is possible with JSON-based rule files.

Installation and Download

nft is installed via package manager or official script.

Installation is verified using nft --version.

Common Options

3 Essential Command Combinations

• nft add table inet filter — Create table
• nft add rule inet filter input tcp dport 22 accept — Allow SSH
• nft list ruleset > /etc/nftables.conf — Persist rules

💬 "Show me examples of using nft on a real server"

I have organized common situations encountered on actual production servers in order.

Step 1 · Installation Check

Check if it is installed.

nft --version || sudo apt install -y nftables

Step 2 · Create Table

Create an IPv4/IPv6 unified table.

sudo nft add table inet filter

Step 3 · Add Rule

Allow SSH and HTTP.

sudo nft add rule inet filter input tcp dport 22 accept

Actual Execution Screen

This is the result of adding nftables rules.

!nft command execution result

Actual production server

In practice, it is used like this

1. SSH Allow Rule

Situation — Ensure SSH access is maintained.

sudo nft add table inet filter
sudo nft 'add chain inet filter input { type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input tcp dport 22 accept

Result — SSH is maintained while other ports are blocked.

Point — It is safe to set the policy to drop and explicitly specify allow rules.

2. Bulk IP Blocking

Situation — Manage malicious IPs as a set.

sudo nft add set inet filter blacklist { type ipv4_addr; }
sudo nft add element inet filter blacklist { 1.2.3.4, 5.6.7.8 }

Result — Adding IPs to the set blocks them immediately.

Point — It is managed dynamically without reloading rules.

Actual Execution Screen

This is the result of querying the entire ruleset with nft list ruleset.

!nft command execution result 2

Actual production server

Precautions

• nft flush ruleset deletes all rules immediately. If SSH is blocked, you cannot access the server. Always ensure console access is available.
• In environments with mixed IPv4/IPv6, the inet family is convenient, but some kernel options require separating the family.
• Using firewalld or ufw simultaneously causes rule conflicts. Choose only one.

Source (HTML): https://games.aidebatehub.com/programs/linux/network/nft.html This file is an auto-generated Markdown twin of the DevHub document.