BlogLinux & scripting
From iptables to nftables: a practical migration
Translate your ruleset to nftables' cleaner syntax and sets, and run both during the cutover without lockouts.
nftables replaces the tangle of iptables, ip6tables, arptables, and ebtables with one tool, one syntax, and native sets. If you still hand-maintain iptables rules, a migration is worth it — but do it without locking yourself out of the box.
nft list rulesettable inet filter { chain input { type filter hook input priority 0; policy drop; }}One table, typed chains
/etc/nftables.conf
table inet filter {set allowed_tcp { type inet_service; elements = { 22, 80, 443 } }chain input {type filter hook input priority 0; policy drop;ct state established,related acceptiif lo accepttcp dport @allowed_tcp accept}}
iptables
4 separate tools
rule-per-port
linear evaluation
no native sets
nftables
one tool
sets and maps
faster lookups
atomic ruleset reload
Do not lock yourself out
Keep an SSH session open, apply with a scheduled rollback (a cron that flushes rules in 5 minutes unless you cancel it), and confirm from a second session before you commit.
Sets make rules readable
Adding a port is editing a set, not appending a rule. That alone makes the ruleset something you can actually review.
Go deeper in a courseLinux hardeningnftables, SSH, SELinux, auditd and CIS — a hardened baseline.View course