nftables Firewall Configuration: Migrating from iptables on Ubuntu
If you manage Bare Metal Servers, you've probably noticed that iptables is being phased out in favor of nftables. If you're running Ubuntu 24.04 LTS or Debian 12, you're already using nftables under the hood through a co
If you manage Bare Metal Servers, you've probably noticed that iptables is being phased out in favor of nftables. If you're running Ubuntu 24.04 LTS or Debian 12, you're already using nftables under the hood through a compatibility layer called iptables-nft.
This guide covers how to move your firewall rules to native nftables syntax and avoid locking yourself out during the switch.
Why Migrate?
- Unified IPv4/IPv6: The new
inettable covers both protocol families. - Native sets: You can group IPs or ports into a set (
tcp dport { 22, 80, 443 } accept). - Performance: Rulesets are compiled to bytecode, which is significantly faster at scale.
Step 1: Export Your Existing Ruleset
Save your current rules as a safety net:
bash
sudo iptables-save > ~/iptables-backup-$(date +%F).rules
sudo ip6tables-save > ~/ip6tables-backup-$(date +%F).rules
Step 2: Translate iptables Rules
nftables ships with translation utilities that provide an excellent starting point:
sudo apt install nftables
iptables-restore-translate -f ~/iptables-backup-$(date +%F).rules
Or translate rule-by-rule:
Bash
iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT
Step 3: Write a Native Configuration
Here is a baseline for a server running SSH and web services in /etc/nftables.conf:
Plaintext
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
# Allow established/related and loopback
ct state established,related accept
iif "lo" accept
# Drop invalid packets
ct state invalid drop
# Allow SSH, HTTP, HTTPS
tcp dport { 22, 80, 443 } accept
}
}
Step 4: Test and Persist
Test the ruleset (keep a second SSH session open in case you lock yourself out!):
Bash
sudo nft -f /etc/nftables.conf
Enable it to persist across reboots:
Bash
sudo systemctl enable --now nftables
To learn about rolling back in emergencies and how local firewalls pair with hardware edge protection, read the full tutorial here: https://www.eservers.uk/tutorials/howto/migrate-iptables-to-nftables-ubuntu-debian/
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.