nftables commands

12 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 12 shown

  • Create input chain with drop policy
    nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }'

    Base-chain default-deny; note: add accept rules first or you lock yourself out

    security · network · firewall

  • Named set as IP blocklist
    nft add set inet filter blocklist '{ type ipv4_addr ; flags interval ; }' && nft add element inet filter blocklist '{ 10.0.0.0/8, 192.0.2.5 }'

    Reusable named set; flags interval lets you store CIDR ranges, not just hosts

    security · network · firewall

  • Verdict map for port dispatch
    nft add rule inet filter input tcp dport vmap '{ 22 : accept, 80 : accept, 443 : accept, 3306 : drop }'

    vmap maps keys to verdicts in O(1); replaces a chain of dport == rules

    network · performance · firewall

  • List ruleset with rule handles
    nft -a list ruleset

    -a prints '# handle N' per rule; you need the handle to delete a single rule

    troubleshooting · network

  • Delete a single rule by handle
    nft delete rule inet filter input handle 7

    Surgical removal without flushing; get the handle from nft -a list ruleset

    network · troubleshooting

  • Named counter on a rule
    nft add rule inet filter input tcp dport 22 counter accept comment \"ssh\"

    Inline counter tracks packets/bytes; reset with nft reset counters inet filter

    monitoring · observability · network

  • SNAT masquerade for outbound NAT
    nft add rule ip nat postrouting oifname \"eth0\" masquerade

    Source-NAT egress to the iface IP; needs a nat-type postrouting chain to exist

    network · cloud · firewall

  • DNAT port forward to internal host
    nft add rule ip nat prerouting iif \"eth0\" tcp dport 443 dnat to 10.0.0.5:8443

    Destination-NAT inbound to a backend; pair with a forward-chain accept rule

    network · cloud · firewall

  • Rate-limit new connections
    nft add rule inet filter input tcp dport 22 ct state new limit rate 10/minute accept

    Throttle SSH brute-force; over-limit packets fall through to the chain policy

    security · performance · network

  • Watch ruleset changes live
    nft monitor ruleset

    Streams add/delete events as they happen; great for debugging dynamic rules

    debug · monitoring · troubleshooting

  • Atomic backup and restore of ruleset
    nft list ruleset > /etc/nftables.conf && nft -f /etc/nftables.conf

    nft -f applies the whole file atomically; partial failure rolls back, no half state

    gitops · network · firewall

  • Hardware flowtable offload
    nft add flowtable inet filter ft '{ hook ingress priority 0 ; devices = { eth0, eth1 } ; }' && nft add rule inet filter forward ct state established flow add @ft

    Offloads established flows to fast path; add 'flags offload' for NIC hardware offload

    performance · network · kernel