What is nftables?
Linux nftables firewall
nftables (the Linux nftables firewall) is the current Linux firewall, configured with the nft command: tables of chains attached to kernel hooks, with rules, sets and maps.
A ruleset is built from tables, each in a family (ip, ip6, or inet for both), containing chains. A base chain hooks into netfilter at input, forward, output, prerouting or postrouting, with a type (filter or nat), a priority and a policy for packets that reach its end. Rules match on almost anything (addresses, ports, interfaces, conntrack state) and end in a statement such as accept, drop, counter, log, dnat or masquerade. Sets and maps hold many values in one rule and can be changed live, and dynamic sets give per-address rate limits. A whole file loads atomically: it either applies completely or not at all.
On Debian, nftables.service loads /etc/nftables.conf at boot; nft -c -f checks a file without loading it, nft list ruleset shows what's running, and nft monitor trace follows a packet through every rule. It replaced iptables, whose commands now write nftables rules too, so both appear in one ruleset. VyOS's firewall is also nftables underneath. The nftables and iptables on Debian lesson builds a host and a router firewall with it.
Lessons that use nftables
- nftables and iptables on Debian: host and router firewallsTeaches this term · Intermediate · 60 min
Build a Debian firewall with nftables, from a host firewall to an office router with NAT and port forwards: safe changes with a timed rollback, sets and maps, logging and packet tracing, and what iptables really is on Debian 13.
- VyOS firewall in depthIntermediate · 45 min
Build a complete VyOS firewall step by step: the input, forward and output hooks, a global state policy, groups, custom chains, protecting the router with rate-limited SSH, egress filtering, rule order, the ICMPv6 that IPv6 can't live without, and the nftables underneath.
- Two internet connections on DebianIntermediate · 45 min
Give a Debian office router a second ISP: a routing table per ISP, source rules and connection marks so replies leave the way they came, per-ISP NAT, and a systemd health check that fails over and back, measured with a real outage.
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.
- Linux Network ConnectivityBeginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- Building a network lab on an Apple Silicon MacBeginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.
- Two internet connections on VyOSIntermediate · 45 min
Add a second ISP to a VyOS office router and make it actually work: why a backup default route misses most outages, health checks that test beyond the ISP, per-ISP NAT, port forwards through both ISPs, and what happens to open connections, all measured on a real lab.
- OpenVPN on Debian: users, routing and revocationIntermediate · 60 min
Install and run an OpenVPN server on Debian with your own certificate authority: one certificate per user, fixed addresses, routing to an office and a branch LAN, split and full tunnels, tls-crypt, revoking users, and the mistakes that lock everyone out.