nftables Configuration & Security
nftables is the modern successor to iptables, available since Linux Kernel 3.13. This guide shows how to set up a secure default-deny firewall with nftables.
iptables or nftables? On modern distributions (Debian 10+, Ubuntu 20.04+, RHEL 8+), nftables is the recommended standard. If you are running an existing server with iptables you can stay with it — for new servers we recommend nftables. View the iptables guide →
Order is critical! Only activate the default-deny policy after explicitly allowing SSH — otherwise you will lock yourself out immediately. Always keep a console connection available via the PowerPanel as a fallback.
nftables vs. iptables — Key Differences
| Feature | iptables | nftables |
|---|---|---|
| Tooling | Separate tools (ip6tables, arptables…) | One unified tool for all protocols |
| Configuration | Line-based commands | Structured rule files (readable like code) |
| Performance | Good | Better — optimized kernel bytecode |
| Future | Legacy, no longer actively developed | Actively developed, default on modern distros |
1. Installation & Preparation
On most modern distributions nftables is already pre-installed. Install it if needed:
If existing iptables rules are active, flush them first to avoid conflicts:
2. Basic Rule Structure
nftables uses tables and chains. A table groups multiple chains together. Unlike iptables, tables and chains must be created explicitly before use.
3. Set Up a Default-Deny Firewall
The recommended approach is to write a complete configuration file and load it. Create or edit /etc/nftables.conf:
Load the configuration:
Check your SSH port! If you run SSH on a port other than 22, update the value in the configuration before loading the rules.
4. Opening Individual Ports
Rules can either be added directly to the configuration file or applied via command at runtime:
Open an additional port (e.g. for a game server)
Restrict database access to a specific IP
Critical ports like MySQL should only be opened for known, trusted IP addresses:
Open a UDP port (e.g. for a game server)
5. Rate Limiting & Protection
SSH Brute-Force Protection
Limits new SSH connection attempts to 5 per minute per IP — add these lines inside the input chain of your configuration file:
Drop Invalid Packets
Already included in the base configuration — drops packets that do not belong to any known connection:
Log Dropped Packets
Add this rule at the end of the input chain, just before the implicit DROP policy:
6. Verify & Save Rules Persistently
Show active rules
Save running rules to file
Export the current running configuration directly to the persistent config file:
Enable service (auto-load on boot)
When the nftables service is enabled, it automatically loads /etc/nftables.conf on every boot. Make sure the configuration file is always up to date after adding rules via command line.
Further Documentation
For a complete reference of all nftables options, refer to the official documentation.