BlogLinux & scripting

From iptables to nftables: a practical migration

Translate your ruleset to nftables' cleaner syntax and sets, and run both during the cutover without lockouts.

May 20, 2025·11 min readAdvanced

nftables replaces the tangle of iptables, ip6tables, arptables, and ebtables with one tool, one syntax, and native sets. If you still hand-maintain iptables rules, a migration is worth it — but do it without locking yourself out of the box.

bash — the new worldlive
nft list ruleset
table inet filter {
chain input { type filter hook input priority 0; policy drop; }
}

One table, typed chains

/etc/nftables.conf
table inet filter {
set allowed_tcp { type inet_service; elements = { 22, 80, 443 } }
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iif lo accept
tcp dport @allowed_tcp accept
}
}
Why switch
iptables
4 separate tools
rule-per-port
linear evaluation
no native sets
nftables
one tool
sets and maps
faster lookups
atomic ruleset reload
Do not lock yourself out
Keep an SSH session open, apply with a scheduled rollback (a cron that flushes rules in 5 minutes unless you cancel it), and confirm from a second session before you commit.

Sets make rules readable

Adding a port is editing a set, not appending a rule. That alone makes the ruleset something you can actually review.

Go deeper in a courseLinux hardeningnftables, SSH, SELinux, auditd and CIS — a hardened baseline.View course

Related posts