Linux Command: nft

nft is the command-line tool for nftables, the modern replacement for iptables. nftables provides unified IPv4/IPv6 packet filtering, NAT, and classification with a cleaner, more consistent syntax. nftables is the default firewall framework in newer Linux distributions (Debian 10+, RHEL 8+). It replaces iptables, ip6tables, arptables, and ebtables with a single framework. nft uses tables, chains, and rules similar to iptables but with a more readable syntax. It supports sets, maps, and concatenations for more efficient rule matching.

Syntax

nft [OPTION]... [COMMAND]

Key Options

• list ruleset — Show all rules
• add table — Create a table
• add chain — Create a chain
• add rule — Add a rule
• flush ruleset — Clear all rules
• delete rule — Remove a rule by handle

Examples

List all rules

sudo nft list ruleset

Allow SSH and web

sudo nft add rule inet filter input tcp dport { 22, 80, 443 } accept

Block IP

sudo nft add rule inet filter input ip saddr 192.168.1.100 drop

Pro Tips

• nftables is the modern successor. Most distributions still support iptables through compatibility layers, but new setups should use nft.
• nft supports sets: tcp dport { 80, 443, 8080 } accept. More efficient than multiple rules.
• Save with nft list ruleset > /etc/nftables.conf. Enable nftables.service for automatic loading on boot.

Learn more: Full nft reference →