nftables
also: nft, nftables firewall
nftables is a modern Linux firewall and packet filtering framework that replaces iptables, offering a unified syntax for managing network rules across different network protocol families.
nftables is the next-generation packet filtering system in the Linux kernel, designed to supersede iptables, ip6tables, and other legacy filtering tools. It provides a single, consistent interface for defining firewall rules regardless of whether you're filtering IPv4, IPv6, or other protocols.
Unlike iptables which uses separate command-line tools and kernel modules for different address families, nftables uses a unified language and command structure. Rules are organized into tables, chains, and individual filtering rules that can match packets based on various criteria (port, IP address, protocol, etc.) and perform actions like accept, drop, or masquerade.
Example: instead of separate iptables and ip6tables commands, you manage both with nft. A simple rule might look like: nft add rule inet filter input tcp dport 22 accept, which accepts SSH traffic for both IPv4 and IPv6 simultaneously.