nftables: Firewall Rules Without the iptables Baggage

Mon, 08 Apr 2024 08:30:00 +0000

iptables has been the default answer to “how do I write firewall rules on Linux” for so long that its warts feel normal. Four separate binaries for four protocol families (iptables, ip6tables, arptables, ebtables), each with its own syntax. Rule matching that’s a linear scan, so a ruleset with thousands of entries — a fail2ban instance with a long ban list, say — gets measurably slower per packet. No native way to group addresses or ports without either duplicating rules or reaching for the clunky ipset extension. nftables replaced all of that in the mainline kernel back in 3.13 (2014), and as of most current distributions it’s the default backend even when you type iptables out of habit — but writing rules in its native syntax rather than through the compatibility shim is where the actual improvements live.

Iptables - vo.rs

nftables: Firewall Rules Without the iptables Baggage