nft

What it does

nftables replaced iptables. firewalld writes its rules into nftables (table inet firewalld). With nft list ruleset you see what the kernel really does. On systems with firewalld, use firewall-cmd for changes; write nft rules yourself only on systems without firewalld (then use nftables.service and /etc/sysconfig/nftables.conf).

How to write it

nft [OPTION]... COMMAND
nft -f FILE

Main parts

list ruleset: Show all rules.
list tables / list table FAMILY NAME: Tables.
list chain FAMILY TABLE CHAIN: One chain.
add table, add chain, add rule: Create.
insert rule, replace rule, delete rule handle N: Change rules.
add set, add element: Address or port sets.
flush ruleset: Remove all rules (dangerous).
monitor: Watch rule changes and traces.
FAMILY: ip, ip6, inet (both), arp, bridge, netdev.

Options 18

Most used

-a, --handle: Show rule handles (needed to delete a rule).
-f, --file FILE: Read commands from a file.
-c, --check: Check the commands, do not apply.
-n, --numeric: Numbers instead of names (addresses, ports).
-N, --reversedns: Resolve IPs to names.
-S, --service: Port numbers as service names.
-s, --stateless: Leave out counters and state.
-t, --terse: Leave out set contents.
-j, --json: JSON output.
-e, --echo: Print what was added.
-i, --interactive: Interactive mode.
-D, --define NAME=VALUE: Define a variable for files.
-I, --includepath DIR: Folder for include files.
-o, --optimize: Optimize the rules.
-y, --numeric-priority, -p, --numeric-protocol, -T, --numeric-time, -u, --guid: More numeric output.
-d, --debug LEVEL: Debug output.
-h, --help: Show help.
-v, --version: Show the version.

Examples 10

$ run as a normal user# run as root (or with sudo)

1All rules
```
#nft list ruleset | less
```
Includes the rules firewalld made.
2Tables
```
#nft list tables
table inet firewalld
```
firewalld's table.
3firewalld zone rules
```
#nft list chain inet firewalld filter_IN_public_allow
```
The services of the public zone as rules.
4Rules with handles
```
#nft -a list ruleset | grep handle | head
```
Handles identify single rules.
5Check a rules file
```
#nft -c -f /etc/sysconfig/nftables.conf
```
Syntax check before loading.

6A simple firewall without firewalld

#nft add table inet filter
#nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
#nft add rule inet filter input ct state established,related accept
#nft add rule inet filter input iif lo accept
#nft add rule inet filter input tcp dport 22 accept

Only on systems where firewalld is off.

7Block a list of attackers with a set

#nft add set inet filter blocklist '{ type ipv4_addr; }'
#nft add element inet filter blocklist '{ 203.0.113.50 }'
#nft add rule inet filter input ip saddr @blocklist drop

Sets scale to many addresses.

8Save the current rules
```
#nft list ruleset > /etc/sysconfig/nftables.conf
```
Loaded by nftables.service at boot.
9Watch rule changes
```
#nft monitor
```
Shows changes live (for example from firewall-cmd).

10JSON for tools

#nft -j list ruleset | jq '.nftables | length'

Machine-readable.

Watch out

Do not change firewalld's tables by hand; a reload overwrites them.
flush ruleset with a drop policy can cut your SSH session.

Files

/etc/sysconfig/nftables.conf: Rules for nftables.service.
/etc/nftables/: Example rule files.

Exit codes

0 :: Done. 1 :: Error.

`nft`

What it does

How to write it

Main parts

Options 18

Examples 10

1All rules

2Tables

3firewalld zone rules

4Rules with handles

5Check a rules file

6A simple firewall without firewalld

7Block a list of attackers with a set

8Save the current rules

9Watch rule changes

10JSON for tools

Watch out

Files

Exit codes

Full manual

What it does

How to write it

Main parts

Options 18

Examples 10

1All rules

2Tables

3firewalld zone rules

4Rules with handles

5Check a rules file

6A simple firewall without firewalld

7Block a list of attackers with a set

8Save the current rules

9Watch rule changes

10JSON for tools

Watch out

Files

Exit codes

Related commands

Used in these lessons

Full manual

`nft`