How to Configure nftables Firewall on Ubuntu 26.04

The nftables framework is the modern firewall subsystem in the Linux kernel, and learning how to nftables configure ubuntu 26.04 systems gives you direct, fine-grained control over network traffic filtering. While UFW provides a simplified frontend, nftables operates at a lower level, offering capabilities such as NAT, port forwarding, and complex rule matching that UFW cannot express. This guide walks you through nftables architecture, rule creation, NAT configuration, and persistence on Ubuntu 26.04.

Software Requirements

Understanding nftables on Ubuntu 26.04

nftables is the packet classification framework that replaced iptables in the Linux kernel starting with version 3.13. Ubuntu adopted nftables as its default firewall backend beginning with Ubuntu 20.10, and Ubuntu 26.04 continues this approach. When you run iptables commands on a modern Ubuntu system, they are actually translated to nftables rules behind the scenes through a compatibility layer called iptables-nft.

The relationship between nftables and UFW is straightforward: UFW is a user-friendly frontend that generates nftables rules automatically. For basic port allow/deny scenarios, UFW is sufficient. However, when you need advanced capabilities such as NAT, port forwarding, rate limiting with fine-grained thresholds, custom chain jumping, or packet mangling, working with nftables directly is necessary.

Key advantages of nftables over the legacy iptables include a unified syntax for IPv4 and IPv6 (using the inet family), atomic rule replacement, built-in sets and maps for efficient matching, and a cleaner rule format. Consequently, understanding nftables is essential for advanced firewall administration on Ubuntu 26.04.

Installing and Enabling nftables on Ubuntu 26.04

Ubuntu 26.04 includes nftables in the default installation. Nevertheless, if the package is missing or you need to confirm its presence, the following steps ensure nftables is installed and running.

1. Install the nftables package: Run the following command to install nftables along with its userspace utility:

   $ sudo apt update
   $ sudo apt install nftables

   This installs the nft command-line tool and the systemd service unit.

2. Enable and start the nftables service: The nftables systemd service loads the ruleset from /etc/nftables.conf at boot:

   $ sudo systemctl enable --now nftables

   This both enables the service for future boots and starts it immediately.

3. Verify the nft version: Confirm that the nft utility is available and check its version:

   $ nft --version

4. Check kernel support: Verify that the nftables kernel modules are loaded:

   $ lsmod | grep nf_tables

   You should see nf_tables listed along with related modules. If no output appears, load the module manually with sudo modprobe nf_tables.

nftables Architecture: Tables, Chains, and Rules

Before creating firewall rules, it is important to understand the three-tier structure that nftables uses to organize packet filtering. This architecture differs significantly from iptables, which has predefined tables and chains.

Tables

A table is the top-level container in nftables. Unlike iptables, where tables like filter, nat, and mangle are predefined, nftables lets you create tables with any name. Each table belongs to an address family that determines which traffic it processes:

For most server and desktop firewalls, the inet family is the best choice because it applies rules to both IPv4 and IPv6 with a single ruleset.

Chains

Chains live inside tables and hold the actual rules. There are two kinds of chains in nftables:

Base chains are attached to a netfilter hook and therefore receive packets from the kernel. When creating a base chain, you specify its type, hook point, and priority. The most common hook points are:

Regular chains are not attached to a hook. They serve as jump targets from other chains, functioning similarly to user-defined chains in iptables.

Rules

Rules are the individual match-and-action statements inside a chain. Each rule consists of expressions that match packet properties (source address, destination port, protocol, etc.) followed by a verdict such as accept, drop, reject, or jump. Rules are evaluated in order, and the first matching rule determines the packet’s fate unless the chain has a default policy.

Creating a Basic nftables Firewall Ruleset on Ubuntu 26.04

This section builds a complete server firewall from scratch using nftables on Ubuntu 26.04. The ruleset allows SSH, HTTP, and HTTPS while dropping all other incoming traffic.

1. Flush any existing rules: Start with a clean slate by removing all current nftables rules:

   $ sudo nft flush ruleset

   This removes every table, chain, and rule currently loaded.

2. Create the filter table: Create an inet family table that handles both IPv4 and IPv6:

   $ sudo nft add table inet linuxconfig_filter

3. Create the input chain: Add a base chain attached to the input hook with a default policy of drop:

   $ sudo nft add chain inet linuxconfig_filter input '{ type filter hook input priority 0; policy drop; }'

   The policy drop means any packet that does not match an explicit rule will be silently discarded.

4. Create the forward chain: Add a forward chain, also with a drop policy:

   $ sudo nft add chain inet linuxconfig_filter forward '{ type filter hook forward priority 0; policy drop; }'

5. Create the output chain: Add an output chain with an accept policy to allow all outbound traffic:

   $ sudo nft add chain inet linuxconfig_filter output '{ type filter hook output priority 0; policy accept; }'

6. Allow established and related connections: This critical rule permits return traffic for connections your system initiated:

   $ sudo nft add rule inet linuxconfig_filter input ct state established,related accept

7. Allow loopback traffic: Local processes communicating via the loopback interface must be permitted:

   $ sudo nft add rule inet linuxconfig_filter input iifname "lo" accept

8. Allow ICMP: Permit ping and other ICMP messages for network diagnostics:

   $ sudo nft add rule inet linuxconfig_filter input ip protocol icmp accept
   $ sudo nft add rule inet linuxconfig_filter input ip6 nexthdr icmpv6 accept

9. Allow SSH, HTTP, and HTTPS: Open the ports for common services using an nftables set:

   $ sudo nft add rule inet linuxconfig_filter input tcp dport { 22, 80, 443 } accept

   The curly braces define an anonymous set, allowing you to match multiple ports in a single rule. This is more efficient than creating separate rules for each port.

10. Verify the ruleset: List all rules to confirm the configuration:

    $ sudo nft list ruleset

The complete ruleset, when listed with sudo nft list ruleset, should look similar to this:

Managing nftables Rules

Once your firewall is running, you will need to add, modify, and remove rules as your requirements change. The nft command provides several operations for managing rules on Ubuntu 26.04.

Listing Rules

To view all currently loaded rules across all tables:

$ sudo nft list ruleset

To list rules for a specific table only:

$ sudo nft list table inet linuxconfig_filter

To list rules within a specific chain:

$ sudo nft list chain inet linuxconfig_filter input

Using Rule Handles

Rule handles are unique numeric identifiers assigned to each rule. They are essential for inserting rules at specific positions or deleting individual rules. To display handles alongside rules:

$ sudo nft -a list chain inet linuxconfig_filter input

The output includes a # handle N comment after each rule, where N is the handle number.

Adding and Inserting Rules

The add command appends a rule at the end of a chain:

$ sudo nft add rule inet linuxconfig_filter input tcp dport 8080 accept

The insert command places a rule at the beginning of a chain:

$ sudo nft insert rule inet linuxconfig_filter input tcp dport 8443 accept

To insert a rule at a specific position, use a handle reference. For example, to add a rule immediately after handle 7:

$ sudo nft add rule inet linuxconfig_filter input position 7 tcp dport 3306 accept

Deleting Rules

Delete a specific rule by its handle number. First list the handles, then delete:

$ sudo nft -a list chain inet linuxconfig_filter input
$ sudo nft delete rule inet linuxconfig_filter input handle 12

Replace 12 with the actual handle number of the rule you want to remove.

Flushing Rules

To remove all rules from a specific chain without deleting the chain itself:

$ sudo nft flush chain inet linuxconfig_filter input

To remove all rules from all chains in a table:

$ sudo nft flush table inet linuxconfig_filter

To flush the entire ruleset (all tables, all chains, all rules):

$ sudo nft flush ruleset

Configuring NAT and Port Forwarding with nftables

Network Address Translation (NAT) is one of the primary reasons administrators choose nftables directly over UFW, which has limited NAT support. nftables handles both source NAT (SNAT/masquerade) for sharing an internet connection and destination NAT (DNAT) for port forwarding.

Enabling IP Forwarding

Before configuring NAT, you must enable IP forwarding in the kernel. This allows the system to route packets between network interfaces:

$ sudo sysctl -w net.ipv4.ip_forward=1

To make this permanent, add or uncomment the following line in /etc/sysctl.conf:

net.ipv4.ip_forward=1

Then apply the change:

$ sudo sysctl -p

Source NAT (Masquerade)

Masquerade is the most common form of source NAT. It rewrites the source address of outbound packets to the address of the outgoing interface, allowing machines on a private network to access the internet through your Ubuntu 26.04 system.

1. Create a NAT table:

   $ sudo nft add table inet linuxconfig_nat

2. Create the postrouting chain: This chain processes packets after the routing decision:

   $ sudo nft add chain inet linuxconfig_nat postrouting '{ type nat hook postrouting priority 100; }'

3. Add the masquerade rule: Replace eth0 with your actual outgoing interface name:

   $ sudo nft add rule inet linuxconfig_nat postrouting oifname "eth0" masquerade

   This rewrites the source address on all packets leaving through eth0.

Additionally, update the forward chain in your filter table to allow forwarded traffic from the internal network:

$ sudo nft add rule inet linuxconfig_filter forward ct state established,related accept
$ sudo nft add rule inet linuxconfig_filter forward iifname "eth1" oifname "eth0" accept

Replace eth1 with your internal-facing interface.

Destination NAT (Port Forwarding)

Destination NAT redirects incoming traffic on a specific port to a different internal host and port. For example, to forward external traffic arriving on port 8080 to an internal server at 192.168.1.100 on port 80:

1. Create the prerouting chain: This chain processes packets before the routing decision:

   $ sudo nft add chain inet linuxconfig_nat prerouting '{ type nat hook prerouting priority -100; }'

2. Add the DNAT rule:

   $ sudo nft add rule inet linuxconfig_nat prerouting tcp dport 8080 dnat ip to 192.168.1.100:80

3. Allow the forwarded traffic: Ensure your forward chain permits this traffic:

   $ sudo nft add rule inet linuxconfig_filter forward ip daddr 192.168.1.100 tcp dport 80 accept

Making nftables Rules Persistent on Ubuntu 26.04

By default, nftables rules exist only in memory and are lost after a reboot. The nftables.service systemd unit loads rules from /etc/nftables.conf at boot, so saving your ruleset to this file ensures persistence.

1. Export the current ruleset: Write the running configuration to the nftables configuration file:

   $ sudo sh -c 'nft list ruleset > /etc/nftables.conf'

   The sh -c wrapper is necessary because the redirect needs root privileges to write to /etc/nftables.conf.

2. Add the shebang line: The configuration file requires an interpreter directive at the top. Open /etc/nftables.conf and ensure the first line reads:

   #!/usr/sbin/nft -f

   If this line is missing, add it before the table definitions. Additionally, add a flush ruleset line immediately after the shebang to ensure a clean state on load:

   #!/usr/sbin/nft -f
   flush ruleset

3. Verify the service is enabled: Confirm the nftables service will start at boot:

   $ sudo systemctl enable nftables
   $ sudo systemctl status nftables

4. Test the configuration: Validate the configuration file syntax without applying it:

   $ sudo nft -c -f /etc/nftables.conf

   The -c flag performs a dry run, checking for syntax errors without modifying the running ruleset.

5. Reload the ruleset from file: To apply the saved configuration without rebooting:

   $ sudo systemctl restart nftables

   Alternatively, load the file directly:

   $ sudo nft -f /etc/nftables.conf

A complete /etc/nftables.conf file combining the filter and NAT rules from this guide looks like this:

#!/usr/sbin/nft -f
flush ruleset

table inet linuxconfig_filter {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        iifname "lo" accept
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept
        tcp dport { 22, 80, 443 } accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}

table inet linuxconfig_nat {
    chain postrouting {
        type nat hook postrouting priority 100;
        oifname "eth0" masquerade
    }

    chain prerouting {
        type nat hook prerouting priority -100;
        tcp dport 8080 dnat ip to 192.168.1.100:80
    }
}

nftables vs UFW: When to Use Each

Choosing between nftables and UFW depends on your specific requirements. The following comparison helps you decide which approach is appropriate for your Ubuntu 26.04 system.

In practice, use UFW when you simply need to open or close ports on a single-interface server. Choose nftables when you need NAT, port forwarding, complex routing rules, or multi-interface firewall configurations.

Conclusion

You have learned how to configure nftables on Ubuntu 26.04, from understanding the table-chain-rule architecture to building a complete firewall, configuring NAT and port forwarding, and persisting your rules across reboots. nftables provides the power and flexibility needed for advanced network configurations that go beyond what UFW offers.

Remember to always test rule changes carefully, maintain SSH access rules to avoid lockouts on remote systems, and keep your /etc/nftables.conf file updated after making changes. For further details on nftables syntax and advanced features, consult the official nftables wiki.

Frequently Asked Questions

1. Can I use nftables and UFW at the same time? It is technically possible since UFW generates nftables rules, but it is not recommended. UFW manages its own tables and chains, and adding custom nftables rules alongside UFW can create conflicts or unexpected behavior. Choose one approach and use it consistently. If you need nftables features, disable UFW with sudo ufw disable first.
2. How do I block a specific IP address with nftables? Add a drop rule at the beginning of your input chain targeting the IP address. For example: sudo nft insert rule inet linuxconfig_filter input ip saddr 203.0.113.50 drop. Using insert rather than add places the rule at the top of the chain, ensuring it is evaluated before any accept rules.
3. How do I implement rate limiting with nftables? Use the limit rate expression within a rule. For example, to limit incoming SSH connections to 3 per minute: sudo nft add rule inet linuxconfig_filter input tcp dport 22 ct state new limit rate 3/minute accept. Packets exceeding the rate fall through to the chain’s default policy, which should be drop.
4. Will my nftables rules survive a system reboot? Only if you save them to /etc/nftables.conf and the nftables.service is enabled. After making changes, always export the running ruleset with sudo sh -c 'nft list ruleset > /etc/nftables.conf' and ensure the file starts with #!/usr/sbin/nft -f and flush ruleset.
5. How do I migrate existing iptables rules to nftables? Ubuntu provides the iptables-translate tool that converts iptables commands to nftables syntax. Run iptables-translate followed by your iptables rule to see its nftables equivalent. For example: iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT produces the corresponding nft command. You can also export entire iptables rulesets with iptables-save | iptables-restore-translate.