Octet

Say this first

nftables is the replacement for iptables, ip6tables, arptables and ebtables, in the kernel since 3.13 and the default on current Debian, Ubuntu and RHEL. It has one tool, nft, one ruleset for all families, and no built-in tables or chains: you create them and attach chains to hooks with a priority. It adds sets and maps, so one rule can match hundreds of addresses, and it loads a whole ruleset atomically from a file. Today's iptables command is usually iptables-nft, which writes nftables rules under the hood.

Go deeper

A small ruleset

Output

table inet filter {
    set admin_nets {
        type ipv4_addr
        flags interval
        elements = { 10.0.50.0/24, 10.0.51.0/24 }
    }
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        iif "lo" accept
        ip saddr @admin_nets tcp dport 22 accept
        tcp dport { 80, 443 } accept
    }
}

Differences that matter

	iptables	nftables
Tools	iptables, ip6tables, ebtables, arptables	nft
Tables and chains	Predefined	You define them, any name
IPv4 and IPv6	Separate rulesets	One `inet` table can do both
Many addresses	One rule each, or ipset	Native sets and maps
Counters	Always on	Only where you write `counter`
Updates	Rule by rule	Atomic, whole file with `nft -f`

Which backend am I on

Output

$ iptables -V
iptables v1.8.10 (nf_tables)

(nf_tables) means iptables-nft: rules you add with iptables appear in nft list ruleset. (legacy) means the old x_tables backend. iptables-translate converts a rule to nft syntax.

They will ask next

What happens if iptables-legacy rules and nftables rules both exist?
Both run. Each base chain on a hook is evaluated in priority order and a packet must survive all of them. An accept in one chain only ends that chain; a drop anywhere is final. That is how a forgotten legacy rule keeps dropping traffic that the nft ruleset allows.
Why does nft let you choose the chain priority?
Several chains can attach to the same hook, and priority orders them, using the same values as the old tables: raw -300, mangle -150, dstnat -100, filter 0, srcnat 100.

Traps

Running nft flush ruleset on a box where Docker or firewalld also own rules. It wipes theirs too.
Forgetting counter and then reading empty counters as "no traffic".

How did you do?Book 8.5 Example Systems