Ubuntu nftables Complete Guide

sudo apt update
sudo apt install nftables

sudo systemctl enable nftables
sudo systemctl start nftables

# Verify version
nft --version

# View everything loaded
sudo nft list ruleset

# List tables only
sudo nft list tables

# List one table
sudo nft list table inet filter

# Service status
sudo systemctl status nftables

# Add table and chains
sudo nft add table inet filter
sudo nft add chain inet filter input \
  '{ type filter hook input priority 0; policy drop; }'

# Add rules
sudo nft add rule inet filter input \
  tcp dport 22 accept

# Insert rule at position 1
sudo nft insert rule inet filter input \
  position 1 iif lo accept

# Add rule before handle N
sudo nft add rule inet filter input \
  position 5 tcp dport 80 accept

# List handles (needed to delete)
sudo nft -a list ruleset

# Delete a specific rule by handle
sudo nft delete rule inet filter input handle 7

# Replace a rule by handle
sudo nft replace rule inet filter input handle 7 \
  tcp dport 22 ct state new limit rate 5/minute accept

# Flush all rules in a chain
sudo nft flush chain inet filter input

# Flush entire ruleset
sudo nft flush ruleset

# Match multiple ports in one rule
tcp dport { 80, 443, 8080 } accept

# Match a CIDR block set
ip saddr { 10.0.0.0/8, 172.16.0.0/12 } drop

Use curly braces inline when you need a quick multi-value match without naming the set.

# Define a named set
sudo nft add set inet filter blocklist \
  { type ipv4_addr; flags interval; }

# Add elements
sudo nft add element inet filter blocklist \
  { 1.2.3.4, 5.6.7.0/24 }

# Reference in a rule
sudo nft add rule inet filter input \
  ip saddr @blocklist drop

# Remove one element
sudo nft delete element inet filter blocklist \
  { 1.2.3.4 }

# Enable IP forwarding first
sudo sysctl -w net.ipv4.ip_forward=1

# Persist across reboots
echo "net.ipv4.ip_forward = 1" \
  | sudo tee /etc/sysctl.d/99-forward.conf

# Add NAT masquerade rule
sudo nft add table ip nat
sudo nft add chain ip nat postrouting \
  '{ type nat hook postrouting priority 100; }'
sudo nft add rule ip nat postrouting \
  oifname "eth0" masquerade

# Forward external port 8080 to internal host
sudo nft add chain ip nat prerouting \
  '{ type nat hook prerouting priority -100; }'

sudo nft add rule ip nat prerouting \
  iifname "eth0" tcp dport 8080 \
  dnat to 192.168.1.10:80

# Also allow forwarded traffic in filter
sudo nft add rule inet filter forward \
  ip daddr 192.168.1.10 tcp dport 80 accept

# /etc/docker/daemon.json
{
  "firewall-backend": "nftables"
}

Only set this if you are intentionally testing the nftables backend. Test thoroughly — container networking behaviour can change.

• Bind containers to 127.0.0.1 so Docker does not publish to all interfaces: -p 127.0.0.1:3000:3000
• Put Nginx in front of containers for public traffic.
• Audit every -p mapping — published ports can bypass nftables.
• Review sudo nft list ruleset after starting Docker to see any changes.

# Add a logging rule before the final drop
sudo nft add rule inet filter input \
  log prefix "NFT DROP: " flags all drop

# Watch the log live
sudo journalctl -f | grep "NFT DROP"

# Or watch kernel log
sudo dmesg -w | grep "NFT"

# Enable trace on SSH traffic (nftrace)
sudo nft add rule inet filter input \
  tcp dport 22 meta nftrace set 1

# Watch the trace output
sudo nft monitor trace

# Remove trace rule when done (use handle from nft -a list)
sudo nft delete rule inet filter input handle N

Packet tracing shows every rule a packet passes through — the most powerful debugging tool in nftables.

• Default policy drop on input
• Allow only required ports
• Use ct state invalid drop
• Rate-limit SSH new connections
• Restrict database ports to localhost or trusted subnet
• Log and drop everything else

• Validate config before reloading: nft -c -f
• Load full ruleset atomically: nft -f /etc/nftables.conf
• Enable nftables service for persistence
• Review rules after every Docker change
• Test from both trusted and untrusted networks
• Document every exception rule

# Dry-run: check syntax without applying
sudo nft -c -f /etc/nftables.conf

# Apply the full config atomically
sudo nft -f /etc/nftables.conf

# Restart service
sudo systemctl restart nftables
sudo systemctl status nftables

# Enable trace on a specific port
sudo nft add rule inet filter input \
  tcp dport 80 meta nftrace set 1

# Watch live trace
sudo nft monitor trace

# Check logs
sudo journalctl -f | grep "NFT"

# Review full ruleset with handles
sudo nft -a list ruleset