nft

Allows configuration of tables, chains and rules provided by the Linux kernel firewall. Nftables replaces iptables. More information: <https://wiki.nftables.org/wiki-nftables/index.php/Main_Page>.

Install

All systems
curl cmd.cat/nft.sh
Debian Debian
apt-get install nftables
Ubuntu
apt-get install nftables
Alpine
apk add nftables
Arch Arch Linux
pacman -S nftables
image/svg+xml Kali Linux
apt-get install nftables
CentOS
yum install nftables
Fedora
dnf install nftables
Windows (WSL2)
sudo apt-get update sudo apt-get install nftables
Raspbian
apt-get install nftables
Docker
docker run cmd.cat/nft nft powered by Commando

Allows configuration of tables, chains and rules provided by the Linux kernel firewall. Nftables replaces iptables. More information: <https://wiki.nftables.org/wiki-nftables/index.php/Main_Page>.

  • View current configuration:
    sudo nft list ruleset
  • Add a new table with family "inet" and table "filter":
    sudo nft add table inet filter
  • Add a new chain to accept all inbound traffic:
    sudo nft add chain inet filter input \{ type filter hook input priority 0 \; policy accept \}
  • Add a new rule to accept several TCP ports:
    sudo nft add rule inet filter input tcp dport \{ telnet, ssh, http, https \} accept
  • Add a NAT rule to translate all traffic from the `192.168.0.0/24` subnet to the host's public IP:
    sudo nft add rule nat postrouting ip saddr 192.168.0.0/24 masquerade
  • Show rule handles:
    sudo nft --handle --numeric list chain family table chain
  • Delete a rule:
    sudo nft delete rule inet filter input handle 3
  • Save current configuration:
    sudo nft list ruleset > /etc/nftables.conf

© tl;dr; authors and contributors