iptables vs nftables: Linux Firewalls

By Kokil Thapa | Last reviewed: September 2026

Choosing between iptables vs nftables: Linux Firewalls is no longer a niche kernel debate. Every Ubuntu 22.04 or 24.04 VPS you deploy for a Laravel app, WooCommerce store, or legal-tech portal sits behind a packet filter. The wrong choice costs you hours of debugging when SSH drops after a deploy. This guide maps how both tools sit on netfilter, compares syntax and performance, and shows when to migrate. If you run production servers in Nepal or abroad, the decision affects daily Linux system administration work directly.

What is the difference between iptables and nftables for Linux firewalls?

Both tools configure the Linux kernel netfilter framework. They decide which packets enter, leave, or traverse your server. Neither is a separate firewall daemon by itself. They are user-space front ends that push rules into kernel tables.

iptables arrived in Linux 2.4 and matured through 2.6. It splits management across four binaries: iptables, ip6tables, arptables, and ebtables. Each targets a different protocol layer. nftables landed in kernel 3.13 and became the recommended interface in 2018. One tool — nft — replaces all four.

On Ubuntu 22.04 and 24.04, nftables is the default backend. UFW still presents a simple interface, but under the hood it may generate nftables rules on fresh installs. Understanding the layer below UFW saves you when configuring a firewall with UFW on Ubuntu is not enough for custom NAT or complex forwarding.

Legacy iptables model

iptables organises rules into tables, each with built-in chains tied to netfilter hooks. The filter table handles allow/deny decisions. The nat table handles address translation. The mangle table adjusts packet headers. The raw table bypasses connection tracking for marked packets.

Rules are evaluated top to bottom within a chain. The first match wins unless a target jumps to another chain. This model is well documented. Stack Overflow answers and old blog posts almost always show iptables syntax.

Modern nftables model

nftables replaces tables-and-chains with a flexible hierarchy: tables contain chains; chains contain rules with expressions. You can define sets and maps inline. A set might hold ten thousand blocked IPs without one rule per address. Updates can be applied atomically — the entire ruleset swaps in one netlink transaction.

That atomic update matters on busy servers. With iptables, flushing and reloading rules creates a brief window where default policy may allow traffic you intended to block. nftables reduces that race. For production support and maintenance contracts, that detail alone justifies learning nft syntax.

How does packet filtering work in iptables vs nftables?

Every incoming SSH session, HTTPS request, or MySQL connection passes through netfilter hooks. Understanding the path helps you write rules that actually match traffic — a common mistake is putting a rule in OUTPUT when the packet hits INPUT.

When a packet arrives on eth0, it enters PREROUTING first. If destined for the local machine, it moves to INPUT. If destined elsewhere and forwarding is enabled, it passes FORWARD then POSTROUTING. Locally generated packets skip PREROUTING and enter OUTPUT, then POSTROUTING.

Side-by-side syntax example

Blocking a single abusive IP on port 443 illustrates the syntax gap. iptables needs separate commands for IPv4 and IPv6 unless you script both.

# iptables — IPv4 only
iptables -A INPUT -p tcp -s 203.0.113.50 --dport 443 -j DROP

# ip6tables — repeat for IPv6
ip6tables -A INPUT -p tcp -s 2001:db8::50 --dport 443 -j DROP

The nftables equivalent uses one inet family table for both protocols:

nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet filter input tcp dport 443 ip saddr 203.0.113.50 drop
nft add rule inet filter input tcp dport 443 ip6 saddr 2001:db8::50 drop

On a web server hosting multiple Laravel apps behind Apache or Nginx, I typically allow established connections, loopback, SSH, HTTP, and HTTPS. Everything else drops. Here is a minimal nftables ruleset you can adapt:

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    set blocked_v4 {
        type ipv4_addr
        flags interval
        elements = { 203.0.113.0/24 }
    }

    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif "lo" accept
        ip saddr @blocked_v4 drop
        tcp dport 22 accept
        tcp dport { 80, 443 } accept
        icmp type echo-request accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Save that to /etc/nftables.conf and enable the service with systemctl enable --now nftables. The same workflow applies whether you host a Laravel booking platform or a static WordPress brochure site. For deeper service management context, see systemd manage services on Linux.

Connection tracking and performance

Both firewalls rely on the kernel conntrack module for stateful filtering. Rules matching ct state established,related (nft) or -m conntrack --ctstate ESTABLISHED,RELATED (iptables) avoid re-evaluating every packet in a TCP session.

Benchmarks vary by rule count. With dozens of rules, the difference is negligible. With tens of thousands — common when blocking crawler nets or running a CDN edge — nftables set lookups outperform equivalent iptables ipset chains. Kubernetes kube-proxy historically used iptables mode; ipvs mode exists partly because large rule sets slow down. That overlap is covered in kube-proxy modes: iptables vs ipvs.

Which Linux firewall should you choose in 2026?

For new Ubuntu 24.04 deployments, use nftables — directly or through UFW. Red Hat Enterprise Linux 9 and Fedora dropped iptables-nft compatibility wrappers as the primary path; nftables is standard. Debian 12 ships nftables as default. Staying on legacy iptables commands via the iptables-nft translation layer works short term but adds confusion when debugging.

Verdict: Choose nftables for any server you will maintain past 2026. Keep iptables knowledge for reading old playbooks and troubleshooting translated rules. Do not start greenfield projects on raw iptables unless a compliance document mandates it.

On shared EC2 infrastructure where I run Deployer 7 and GitLab CI for sister legal-tech sites, every new instance gets UFW with a documented baseline. Custom nftables rules sit alongside UFW for edge cases UFW cannot express — such as rate limiting with meter tables or marking packets for policy routing.

How do you migrate from iptables to nftables on Ubuntu?

Migration is incremental on modern Ubuntu. The iptables-nft package provides iptables commands that translate to nftables backend rules. Your old scripts keep working while you rewrite them.

Step 1: Audit current rules

1. Run iptables-save > /root/iptables-backup-$(date +%F).rules
2. Run ip6tables-save >> /root/iptables-backup-$(date +%F).rules
3. List active nftables rules: nft list ruleset
4. Check UFW status: ufw status verbose

Before touching anything, confirm out-of-band access. A misconfigured INPUT chain drops your SSH session. Use the cloud provider console, IPMI, or a serial console. I have locked myself out twice in fifteen years. Both times console access saved the deploy.

Step 2: Translate rules

Install translation tools and convert the saved ruleset:

apt install iptables-translate nftables
iptables-translate < /root/iptables-backup.rules > /etc/nftables.conf
nft -c -f /etc/nftables.conf

The -c flag checks syntax without applying. Review the output manually. Translators handle common filter rules well. Complex NAT, MARK targets, or custom chains may need hand editing. Official guidance lives on the nftables wiki migration page.

Step 3: Apply and persist

systemctl stop ufw
systemctl disable ufw
nft -f /etc/nftables.conf
systemctl enable --now nftables
systemctl status nftables

Test SSH from a second terminal before closing your primary session. Verify HTTP and HTTPS from outside. On a Laravel app, hit a health endpoint and confirm queue workers still reach Redis on localhost. Redis binds to 127.0.0.1 — your INPUT chain must allow loopback, which the template above does.

Once validated manually, codify the ruleset in Ansible playbooks for PHP server provisioning. Store /etc/nftables.conf in version control. Deploy through CI the same way you ship application code. Sister sites on shared infrastructure — including Notary Kathmandu — benefit from identical firewall baselines across every VPS.

How do UFW and firewalld relate to iptables vs nftables?

UFW (Uncomplicated Firewall) is not a third firewall engine. It is a wrapper that generates backend rules. On current Ubuntu, those rules target nftables. You still edit /etc/ufw/before.rules or after.rules for raw iptables-syntax snippets on some setups, but the default path is nft.

firewalld on RHEL and Fedora uses nftables directly through its D-Bus interface. Zones and services map to nft chains. Neither tool removes the need to understand netfilter hooks when debugging a dropped packet.

Practical UFW baseline for web servers

For most Laravel and WordPress deployments I manage, UFW covers 95% of needs. The detailed rule patterns are in UFW firewall rules for web servers. Typical setup:

ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable
ufw status numbered

When a client needs fail2ban integration, geo-blocking, or Docker-published ports that bypass UFW, I drop to raw nftables. Docker manipulates iptables/nftables chains directly — a frequent source of "but UFW says deny" confusion. The published port bypasses UFW because Docker inserts rules earlier in the netfilter pipeline.

fail2ban and logging

fail2ban reads auth logs and inserts temporary block rules. Current fail2ban releases support nftables actions via nftables-multiport jails. Ensure your jail config matches the backend:

# /etc/fail2ban/jail.local excerpt
[sshd]
enabled  = true
banaction = nftables-multiport
maxretry = 5
bantime  = 3600

Log denied packets for troubleshooting with a dedicated nftables chain or ulogd. Excessive logging on high-traffic eCommerce sites fills disks — rate-limit log rules or sample in production. For security hardening beyond the network layer, application-level auth belongs in your Laravel middleware or Symfony firewall config, as described in Symfony security firewall configuration.

Automation and compliance notes

Document every open port with its business justification. Port 3306 (MySQL) should never face the public internet on a single-server Laravel stack. Bind database services to private interfaces. Use SSH key auth and disable password logins before tightening firewall rules.

For teams preparing DevOps interviews, firewall fundamentals appear regularly alongside systemd and SSH hardening. Review Linux interview questions for DevOps for the common follow-up prompts.

Application security complements network rules. A properly configured Linux firewall still leaves SQL injection and XSS open if the code is weak. Pair infrastructure hardening with testing and optimization on the application layer. Strong credentials matter too — generate unique secrets with a password generator rather than reusing admin passwords across client servers.

Hosting choices affect what you can configure. Some managed panels expose only a web UI for port rules. On self-managed VPS instances from domain registration and hosting providers, you control the full stack. Know which layer your provider manages before you assume nftables access.

The Netfilter project maintains both interfaces today. Kernel documentation at netfilter.org remains the authoritative reference for hook priorities and extension modules. Ubuntu documents UFW behaviour in the Ubuntu Server firewall guide.

Key Takeaways

• iptables and nftables both configure netfilter — they are front ends, not competing kernel firewalls.
• Choose nftables for new Ubuntu 24.04 and RHEL 9 servers; use atomic rulesets and native sets for scale.
• Always keep console or IPMI access open before applying INPUT policy changes.
• UFW and firewalld wrap nftables on modern distros — learn raw nft when wrappers fall short.
• Migrate legacy iptables scripts with iptables-translate, then codify the result in Ansible.
• Pair network-level rules with application auth, fail2ban, and proper service binding — firewall alone is not enough.

People Also Ask

Is iptables deprecated in 2026?

iptables is in maintenance mode. The kernel netfilter team recommends nftables for new work. iptables commands still function on most distros through the iptables-nft compatibility layer, but that layer adds indirection. Plan to write new rules in nft syntax and migrate existing scripts during routine server upgrades.

Does Ubuntu 24.04 use iptables or nftables?

Ubuntu 24.04 uses nftables as the default netfilter backend. UFW generates nftables rules on fresh installs. You can verify the active backend with nft list ruleset and update-alternatives --display iptables. Either command shows whether iptables-nft or legacy iptables-legacy is linked.

Can Docker and nftables coexist?

Yes, but Docker inserts its own forward and nat rules. UFW may not filter Docker-published ports because Docker rules take precedence in the netfilter pipeline. Use Docker's iptables: false setting with manual nftables rules, or publish ports only on internal networks, when strict perimeter control is required.

Which is faster — iptables or nftables?

For typical web servers with under a few hundred rules, performance is identical. nftables pulls ahead with large sets, interval lookups, and frequent atomic updates. Bottlenecks on Laravel hosts usually come from PHP, database queries, or missing connection tracking — not firewall rule evaluation.

Pick the right Linux firewall for your next deploy

The iptables vs nftables: Linux Firewalls choice is settled for greenfield work: nftables wins on syntax, atomic updates, and IPv6 unification. Keep iptables literacy for legacy environments and translated rules. Start with UFW on Ubuntu, drop to raw nft when requirements outgrow the wrapper, and always test from a second session before you close SSH.

Need firewall baselines, fail2ban tuning, or hardened VPS setup for a production app? Contact us for server hardening alongside your web development project. You can also browse the portfolio for examples of production systems shipped with proper infrastructure from day one, or read more on the blog and about me page.