nftables Configuration & Security
This guide shows how to set up a default-deny firewall with nftables, the successor to iptables, on Debian, Ubuntu, AlmaLinux or Rocky Linux. It covers a complete /etc/nftables.conf, opening ports, rate limiting and saving rules persistently.
iptables or nftables? On current distributions such as Debian 13, Ubuntu 24.04, AlmaLinux and Rocky Linux, nftables is the default framework. If you are running an existing server with iptables you can stay with it — for new servers we recommend nftables. View the iptables guide →
Order is critical! Only activate the default-deny policy after explicitly allowing SSH — otherwise you will lock yourself out immediately. Keep a second SSH session open and use the rescue mode in the PowerPanel as a fallback.
nftables vs. iptables — Key Differences
| Feature | iptables | nftables |
|---|---|---|
| Tooling | Separate tools (ip6tables, arptables…) | One unified tool for all protocols |
| Configuration | Line-based commands | Structured rule files (readable like code) |
| Performance | Good | Better — optimized kernel bytecode |
| Future | Legacy, no longer actively developed | Actively developed, default on modern distros |
1. Installation & Preparation
On most modern distributions nftables is already pre-installed. Install it if needed:
If existing iptables rules are active, reset the policies and flush the rules first to avoid conflicts and lockouts:
2. Basic Rule Structure
nftables uses tables and chains. A table groups multiple chains together. Unlike iptables, tables and chains must be created explicitly before use.
3. Set Up a Default-Deny Firewall
The recommended approach is to write a complete configuration file and load it. Create or edit /etc/nftables.conf:
Load the configuration:
Check your SSH port! If you run SSH on a port other than 22, update the value in the configuration before loading the rules.
4. Opening Individual Ports
Rules can either be added directly to the configuration file or applied via command at runtime:
Open an additional port (e.g. for a game server)
Restrict database access to a specific IP
Critical ports like MySQL should only be opened for known, trusted IP addresses:
Open a UDP port (e.g. for a game server)
5. Rate Limiting & Protection
SSH Brute-Force Protection
Limits new SSH connection attempts to 5 per minute (in total, not per IP). In the input chain of your configuration file, replace the line tcp dport 22 accept with these two lines:
Drop Invalid Packets
Already included in the base configuration — drops packets that do not belong to any known connection:
Log Dropped Packets
Add this rule at the end of the input chain, just before the implicit DROP policy. The limit statement must come before log, otherwise every packet is logged:
6. Verify & Save Rules Persistently
Show active rules
Save running rules to file
Export the current running configuration directly to the persistent config file:
Enable service (auto-load on boot)
When the nftables service is enabled, it automatically loads /etc/nftables.conf on every boot. Make sure the configuration file is always up to date after adding rules via command line, and add flush ruleset as the first line again after exporting. On AlmaLinux and Rocky Linux, the service loads /etc/sysconfig/nftables.conf instead — save your rules there or include your file from it.
Further Documentation
For a complete reference of all nftables options, refer to the official documentation.