nftables or iptables: which one should I choose?

nftables is the newer, default firewall in current Linux distributions (Debian 10+, RHEL 8+, Ubuntu). It has cleaner syntax and handles IPv4 and IPv6 in one inet family. iptables is the older, still common standard, especially on existing servers. On new installations choose nftables; use iptables when you need to stay compatible with an existing configuration.

How do I avoid locking myself out of SSH when deploying a firewall?

Make sure the rule allowing the SSH port is loaded before the drop policy, and deploy changes from a console (KVM, hosting panel) or from a second, already-open session. A good practice is a temporary job that restores the previous rules after a few minutes, in case the new ones cut off access.

Linux Firewall Generator (nftables, iptables)

Home / Tools

nftables and iptables in brief

Linux has filtered traffic in the kernel for years through the netfilter subsystem, which two tools give access to. iptables is the classic, ubiquitous interface, where rules are added one command at a time in the INPUT, OUTPUT and FORWARD chains. nftables is its successor: it has a cleaner, declarative syntax, handles IPv4 and IPv6 in one inet family and is the default backend in new distributions. This generator produces the configuration in the syntax you choose, keeping the same secure layout: default drop, accept established/related state, loopback, explicit rules for SSH and selected services. A firewall is best treated as one element of broader server maintenance and hardening, alongside updates, backups and monitoring.

What makes a secure server firewall

Default-deny policy An input chain with a default drop policy, followed by explicit accept rules only for the services you need. Anything unforeseen is dropped.

State tracking (conntrack) A rule accepting established/related means it is enough to allow traffic in one direction and the responses pass automatically. Invalid packets are dropped.

Loopback Accepting traffic on the lo interface is required for services that communicate locally. Missing it is a common cause of failures after enabling the firewall.

SSH with rate limiting Limiting the rate of new connections to the SSH port (limit rate) makes dictionary attacks harder. Optionally narrow access to trusted source addresses.

Scan and SYN-flood protection Dropping packets with unusual flags and rate-limiting new connections reduces the impact of port scanning and simple volumetric attacks.

Frequently asked questions about Linux firewalls

nftables or iptables?+

nftables is the newer, default firewall in current distributions (Debian 10+, RHEL 8+, Ubuntu), with cleaner syntax and IPv4/IPv6 in the inet family. iptables is the older standard, still common. On new installations choose nftables.

How do I load an nftables configuration?+

Save to /etc/nftables.conf, check: nft -c -f /etc/nftables.conf, load: nft -f /etc/nftables.conf. Enable at boot: systemctl enable --now nftables. Inspect rules with nft list ruleset.

How do I make iptables rules persistent?+

iptables commands last until reboot. To persist, use iptables-persistent (Debian/Ubuntu): netfilter-persistent save or iptables-save > /etc/iptables/rules.v4. On RHEL use iptables-services.

How do I avoid locking myself out of SSH?+

The rule allowing SSH must come before the drop policy. Deploy from a KVM console or a second session. A temporary job that restores the previous rules, in case the new ones cut off access, helps.

Does the generator send my configuration to a server?+

No. The configuration is assembled in your browser with JavaScript. The ports, addresses and interfaces you enter are never sent or stored anywhere beyond your device.

Tool and write-up: Marcin Szewczyk-Wilgan, WebOptimo. Syntax based on the nftables and iptables documentation and hands-on practice configuring firewalls on Linux servers. Test the generated configuration before deploying. The generator runs in your browser, with no data sent.

Contact

We'll configure your server's firewall

We design and deploy nftables and iptables rules, harden Linux servers and look after infrastructure. No obligation — a concrete proposal after a short conversation.

Phone