Skip to content
Browse

/compare/iptables/iptables-vs-nftables

iptables vs nftables: differences and migration

The commands on this page have not been executed by our verification runner yet.updated 2026-10-20
tool
iptables / nftables
compares
iptables vs nftables

nftables is the successor of iptables in the Linux kernel's netfilter framework. One command, nft, and one ruleset language cover IPv4, IPv6, ARP and bridge filtering, and a whole ruleset can be replaced atomically. Most current distributions use nftables underneath; their iptables command is often iptables-nft, which translates iptables syntax to nftables rules.

Criterion by criterion

Criterioniptablesnftables
Toolsiptables, ip6tables, arptables, ebtablesnft
Tables and chainspredefined (filter, nat, mangle…)you create them; no empty default chains
IPv4 and IPv6separate rule setsone inet table for both
Sets and mapsipset as a separate toolbuilt in
Updatesrule by ruleatomic: nft -f replaces the ruleset in one transaction
Several actions per ruleno (one target)yes (counter, log and accept in one rule)

The same rule in both

bash
# iptables: allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# nftables: allow SSH for IPv4 and IPv6
nft add rule inet filter input tcp dport 22 accept

Migrate

  • iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT prints the equivalent nft command.
  • iptables-save > rules.v4 && iptables-restore-translate -f rules.v4 > ruleset.nft converts a saved ruleset.
  • Check which backend your iptables uses with iptables -V: (nf_tables) means iptables-nft, (legacy) the old backend.

Sources

Related pages

config · wireguardWireGuard AllowedIPs: routing and peer filtering explainedWireGuard AllowedIPs lists the addresses a peer may send from and the routes sent to it. 0.0.0.0/0, ::/0 routes all traffic; a /32 per peer limits it to one IP.errors · certbotCertbot: Problem binding to port 80: Could not bind to IPv4 or IPv6certbot --standalone fails with Problem binding to port 80 when nginx, Apache or another service already listens there. Use the webroot or nginx plugin instead.codes · coreutilsLinux signals: numbers, names and default actionsLinux signal numbers on x86 and ARM: SIGHUP 1, SIGINT 2, SIGKILL 9, SIGTERM 15, SIGCHLD 17, SIGSTOP 19, with their default action and the exit code 128+n.