Welcome to the nftables HOWTO documentation page. Here you will find documentation on how to build, install, configure and use nftables.
This documentation was initially started by Eric Leblond, known as the nftables quick HOWTO, and it has been extended and enhanced by Pablo Neira Ayuso.
If you have any suggestion to improve it, please send your comments to Netfilter users mailing list <firstname.lastname@example.org>.
Note that this documentation is still under development, so consider this work in progress.
- What is nftables?
- Why nftables?
- Main differences with iptables
- Netfilter hooks and integration with existing Netfilter components.
- Building and installing nftables from sources
- Using nftables from distributions
- Troubleshooting and FAQ
- Configuring tables
- Configuring chains
- Simple rule management
- Atomic rule replacement
- Error reporting from the command line
- Building rules through expressions
- Operations at ruleset level
- Monitoring ruleset updates
Supported selectors for packet matching
- Matching packet header fields
- Matching packet metainformation
- Matching connection tracking stateful metainformation
- Rate limiting matchings
Possible actions on packets
- Accepting and dropping packets
- Jumping to chain
- Rejecting traffic
- Logging traffic
- Performing Network Address Translation (NAT)
- Setting packet metainformation
- Queueing to userspace
- Duplicating packets
Note that, unlike iptables, you can perform several actions in one single rule.
Advanced data structures for performance packet classification
You will have to redesign your rule-set to benefit from these new nice features:
If you are already using ipset in your iptables rule-set, that transition may be a bit more simple to you.
To the NLnet foundation for initial sponsorship of this HOWTO: