nftables

Modern Linux packet filtering framework replacing iptables.

high risk

interactive breakdown — edit the command and press Explain
$ 
⚠ Risks & cautions
Safer / dry-run alternatives
nft -c -f /etc/nftables.confCheck the syntax without applying.
nft list ruleset > /root/nft.backupBack up first.
What it does

nftables is the successor to iptables/ip6tables, using a unified syntax for IPv4, IPv6, ARP, and bridge filtering. It's the default on Debian 10+, RHEL 8+. Rules are organized into tables → chains → rules. The nft command manages everything.

Examples
nft list rulesetShow all current nftables rules · explain & risk-check →
nft add table inet filterCreate a table for IPv4+IPv6 filtering · explain & risk-check →
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'Create input chain with default drop policy · explain & risk-check →
nft add rule inet filter input tcp dport 22 acceptAllow SSH · explain & risk-check →
nft -f /etc/nftables.confLoad rules from config file · explain & risk-check →
Pro tip

Use `nft list ruleset > /etc/nftables.conf` to export and save current rules — then `nft -f /etc/nftables.conf` on boot to restore them. Much cleaner than iptables-save.

Related
iptables firewalld ufw
Open the full explainer →More in Networking

Reference text is hand-written and may be incomplete — check man nftables for your version. Test destructive commands on a non-production system first.