---
title: nft — netfilter4 firewall management
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: Manages the nftables subsystem of the Linux kernel. It is the successor to iptables.
tags: program, Network and Firewall, nft
---

**💬 "nft command"**

nft manages the **Netfilter4 firewall management** Linux kernel's nftables subsystem. It is the successor to iptables.

It unifies iptables, ip6tables, arptables, and ebtables into one. It allows bulk IP management with dynamic sets.

- **Concept**: It unifies iptables, ip6tables, arptables, and ebtables into one.
- **Main feature**: It allows bulk IP management with dynamic sets.
- **Advantage**: No traffic disruption due to atomic rule replacement.
- **Usage**: Version control is possible with JSON-based rule files.
## Installation and Download

nft is installed via package manager or official script.

| Environment | Command |
| --- | --- |
| Ubuntu 22.04+ | sudo apt install nftables |
| RHEL / CentOS 9+ | sudo dnf install nftables |
| Arch | sudo pacman -S nftables |
| Verify | nft --version |
| Start service | sudo systemctl enable --now nftables |

Installation is verified using `nft --version`.

## Common Options

| Option | Description |
| --- | --- |
| nft list ruleset | Displays the current entire ruleset |
| nft -f <file> | Loads rule files in bulk |
| nft add table inet filter | Creates an IPv4/IPv6 unified table |
| nft add chain ... | Creates a chain |
| nft flush ruleset | Deletes the entire ruleset (caution) |

## 3 Essential Command Combinations

- `nft add table inet filter` — Create table
- `nft add rule inet filter input tcp dport 22 accept` — Allow SSH
- `nft list ruleset > /etc/nftables.conf` — Persist rules
**💬 "Show me examples of using nft on a real server"**

I have organized common situations encountered on actual production servers in order.

### Step 1 · Installation Check

Check if it is installed.

```
nft --version || sudo apt install -y nftables
```

### Step 2 · Create Table

Create an IPv4/IPv6 unified table.

```
sudo nft add table inet filter
```

### Step 3 · Add Rule

Allow SSH and HTTP.

```
sudo nft add rule inet filter input tcp dport 22 accept
```

## Actual Execution Screen

This is the result of adding nftables rules.

![nft command execution result](https://games.aidebatehub.com/assets/nft-demo.png)

Actual production server

## In practice, it is used like this

### 1. SSH Allow Rule

**Situation** — Ensure SSH access is maintained.

```
sudo nft add table inet filter
sudo nft 'add chain inet filter input { type filter hook input priority 0; policy drop; }'
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input tcp dport 22 accept
```

**Result** — SSH is maintained while other ports are blocked.

**Point** — It is safe to set the policy to drop and explicitly specify allow rules.

### 2. Bulk IP Blocking

**Situation** — Manage malicious IPs as a set.

```
sudo nft add set inet filter blacklist { type ipv4_addr; }
sudo nft add element inet filter blacklist { 1.2.3.4, 5.6.7.8 }
```

**Result** — Adding IPs to the set blocks them immediately.

**Point** — It is managed dynamically without reloading rules.

## Actual Execution Screen

This is the result of querying the entire ruleset with nft list ruleset.

![nft command execution result 2](https://games.aidebatehub.com/assets/nft-demo2.png)

Actual production server

## Precautions

- nft flush ruleset deletes all rules immediately. If SSH is blocked, you cannot access the server. Always ensure console access is available.
- In environments with mixed IPv4/IPv6, the inet family is convenient, but some kernel options require separating the family.
- Using firewalld or ufw simultaneously causes rule conflicts. Choose only one.

---
Source (HTML): https://games.aidebatehub.com/programs/linux/network/nft.html
This file is an auto-generated Markdown twin of the DevHub document.