nft(8)
nft is the command-line tool for configuring the netfilter packet filtering framework using the nftables ruleset language.
Synopsis
nft [ -n ] [ -s ] [ -f filename | -e ] [ cmd ]Description
nft is used to set up, maintain, and inspect packet filtering rules in the Linux kernel's netfilter subsystem. It replaces older tools like iptables, ip6tables, and arptables with a unified, more powerful syntax. Rules are organized into tables and chains that process packets according to defined conditions and actions.
Rules can be created interactively, loaded from a file, or piped directly. nft supports variables, loops, and complex expressions, making it more flexible than legacy firewall tools. Changes take effect immediately unless explicitly saved to a configuration file.
Common options
| Flag | What it does |
|---|---|
-n, --numeric | Display IP addresses and port numbers in numeric form instead of resolving to names |
-s, --stateless | Omit stateful information (like packet/byte counters) in list output |
-f, --file filename | Read and execute nftables commands from a file |
-e, --echo | Echo the commands being executed before running them |
-j, --json | Output results in JSON format for scripting |
-a, --handle | Include rule handle numbers in list output (useful for deleting specific rules) |
-c, --check | Check ruleset syntax without loading it |
-t, --terse | Produce shorter output, one rule per line |
Examples
Display all existing nftables tables (both ipv4 and ipv6)
nft list tablesCreate a new IPv4 table named 'filter'
nft add table ip filterAdd an input chain to filter table with default hook and priority
nft add chain ip filter input { type filter hook input priority 0; }Allow SSH (port 22) traffic on the input chain
nft add rule ip filter input tcp dport 22 acceptView all rules in the input chain with line numbers
nft list chain ip filter inputList input chain rules with handles for easy deletion
nft -a list chain ip filter inputRemove the rule with handle 5 from the input chain
nft delete rule ip filter input handle 5Load firewall rules from a configuration file
nft -f /etc/nftables.conf