After upgrading a Rocky Linux 10 server, I found that the newest kernel no longer loads the legacy iptables modules I was using. I started looking at nftables, but the command-line syntax feels much more verbose than iptables. A simple port-forward from ServerA:80 to ServerB:80 takes several setup commands instead of the two familiar iptables rules I was used to. What are the practical advantages of nftables, and was there really anything wrong with iptables? Is there a better way to manage nftables than typing every command individually?
4 Answers
If you want to keep the iptables syntax for now, check whether the compatibility frontend is installed. On modern distributions, `iptables` commonly uses the nftables backend through the iptables-nft translation layer. That lets existing scripts continue working while the actual packet filtering is handled by nftables. It’s a reasonable transition path, although native nftables is the better long-term choice for new configurations.
Don’t build a ruleset by entering a long series of commands manually. Put it in an nftables configuration file with proper indentation, then load or reload the complete file. Your port-forward can be expressed declaratively in one readable ruleset, and the entire change can be applied atomically. In practice, the only nft command many administrators use regularly is `nft list ruleset`; the rest is editing the configuration and reloading the service.
That was what made nftables click for me too. Editing a config file and applying it with `nft -f` feels much closer to maintaining an ordinary firewall rules file than typing every command separately.
The syntax and documentation can still be frustrating, but the file format is much easier to review and automate than a pile of imperative commands.
Most of the complaints are about familiarity and the interactive CLI rather than the firewall engine itself. Nftables provides cleaner data structures, atomic updates, reusable sets, better support for IPv4 and IPv6 in a shared `inet` family, and more expressive matching. I found iptables easier only because I had memorized its flags. After switching to a formatted configuration file, nftables became easier to maintain.
The biggest adjustment is that nftables is designed around a ruleset and configuration structure rather than isolated one-line commands. Tables and chains are explicit, which makes it easier for different tools or administrators to manage separate parts of the firewall without overwriting each other. It also supports atomic reloads, more flexible rule priorities, sets, maps, and combined IPv4/IPv6 rules. The command line looks awkward at first, but the underlying model is more composable.
Having separate chains is especially useful when multiple services manage firewall rules. A container runtime and a firewall manager can keep their own rules instead of competing for the same predefined chains.
This compatibility layer is why many people think they are still using legacy iptables when the kernel is actually processing an nftables ruleset underneath.