snippetbashTip

nft — Allows configuration of tables, chains, and rules provided by the Linux kernel firewall. Nftables re

Submitted by: @import:tldr-pages·Mar 2, 2026·

Viewed 0 times

configurationcommandandclitableschainsallowsnft

linux

Problem

How to use the nft command: Allows configuration of tables, chains, and rules provided by the Linux kernel firewall. Nftables replaces iptables. More information: <https://wiki.nftables.org/wiki-nftables/index.php/Main_Page>.

Solution

nft — Allows configuration of tables, chains, and rules provided by the Linux kernel firewall. Nftables replaces iptables. More information: <https://wiki.nftables.org/wiki-nftables/index.php/Main_Page>.

View current configuration:

sudo nft list ruleset

Add a new table with family "inet" and table "filter":

sudo nft add table {{inet}} {{filter}}

Add a new chain to accept all inbound traffic:

sudo nft add chain {{inet}} {{filter}} {{input}} \{ type {{filter}} hook {{input}} priority {{0}} \; policy {{accept}} \; \}

Add a new rule to accept several TCP ports:

sudo nft add rule {{inet}} {{filter}} {{input}} {{tcp}} {{dport \{ telnet, ssh, http, https \} accept}}

Add a NAT rule to translate all traffic from the 192.168.0.0/24 subnet to the host's public IP:

sudo nft add rule {{nat}} {{postrouting}} ip saddr {{192.168.0.0/24}} {{masquerade}}

Show rule handles:

sudo nft --handle --numeric list chain {{family}} {{table}} {{chain}}

Delete a rule:

sudo nft delete rule {{inet}} {{filter}} {{input}} handle {{3}}

Save current configuration:

sudo nft list ruleset > {{/etc/nftables.conf}}

Code Snippets

View current configuration

sudo nft list ruleset

Add a new table with family "inet" and table "filter"

sudo nft add table {{inet}} {{filter}}

Add a new chain to accept all inbound traffic

sudo nft add chain {{inet}} {{filter}} {{input}} \{ type {{filter}} hook {{input}} priority {{0}} \; policy {{accept}} \; \}

Add a new rule to accept several TCP ports

sudo nft add rule {{inet}} {{filter}} {{input}} {{tcp}} {{dport \{ telnet, ssh, http, https \} accept}}

Add a NAT rule to translate all traffic from the `192.168.0.0/24` subnet to the host's public IP

sudo nft add rule {{nat}} {{postrouting}} ip saddr {{192.168.0.0/24}} {{masquerade}}

Context

tldr-pages: linux/nft

Revisions (0)

No revisions yet.