nftables

nftables is Linux's current packet-filtering framework — merged in kernel 3.13 (January 2014) under netfilter's Patrick McHardy, replacing the iptables family (ip/ip6/arp/eb) with one subsystem and one userspace tool, nft. Where iptables hardcoded four separate table chains per protocol, nftables is a small register-machine: rules compile to bytecode the kernel executes — jumps, comparisons, set lookups, verdicts — so a decade of bolt-on iptables extensions became expressions in a real grammar.^[1]

What it buys you

The practical wins: named sets and maps (ip saddr { 10.0.0.1, 10.0.0.7 } inline, or mutable sets you add to without rewriting rules), vmaps (lookup → verdict), the inet family (IPv4 + IPv6 in one table — the reason nft kills the dual-rulebook problem), atomic ruleset replacement (nft -f swaps the world in one transaction), and iptables-translate for migrating old rules. The netdev family even filters at ingress before packets reach the stack.^[2]

Reading it

nft list ruleset prints the whole firewall as a script — tables own chains own rules, type filter hook input priority filter; policy drop; declares the chain's place in the pipeline, and counters sit inline. The migration story is gentle by design: iptables commands still work through compat translation on most distros, but anything new is written in nft — chapter 18's firewall section and the security chapter's hardening checklist both speak it natively.^[3]

See also

• Networking — where nft first appears in the handbook
• Linux Security — the hardening checklist uses it
• Inside a Linux System — netfilter's place in the kernel
• Linux · WireGuard · SELinux