nft

List current ruleset

$ sudo nft list ruleset

$ sudo nft add table inet filter

$ sudo nft add chain inet filter input \{ type filter hook input priority 0 \; policy accept \; \}

$ sudo nft add rule inet filter input tcp dport \{ ssh, http, https \} accept

$ sudo nft add rule nat postrouting ip saddr 192.168.0.0/24 masquerade

$ sudo nft --handle --numeric list chain family table chain

$ sudo nft delete rule inet filter input handle 3

$ sudo nft list ruleset > /etc/nftables.conf

nft [OPTIONS] [commands]

nft is the command-line interface for nftables, the modern Linux kernel packet filtering framework. It replaces iptables, ip6tables, arptables, and ebtables with a unified syntax and improved performance.

list ruleset

Display the current complete ruleset

Create a new table

Create a new chain

Add a rule to a chain

Delete a rule by its handle

Remove all rules and tables

Show rule handles for deletion

Show numeric output (no name resolution)

Nftables syntax differs significantly from iptables. Tables must exist before chains, chains before rules. Changes are immediate but not persistent by default - save to /etc/nftables.conf for persistence.

nft is part of the nftables project, the successor to iptables, providing unified packet classification framework in the Linux kernel.

iptables(8), firewall-cmd(1)