The main problem stems from the fact that the ruleset representation is shared by the frontend tools like iptables and the kernel. From an architectural point of view it also replaces those parts of the kernel that deal with run-time evaluation of the packet filtering rule set.ĭespite its success, iptables has several architectural limitations that cannot be resolved without many fundamental design changes. It re-uses many parts of the netfilter framework, such as the connection tracking and NAT facilities. It also retains several parts of the nomenclature and basic iptables design, such as tables, chains and rules. Just like with iptables, tables serve as containers for chains, and the chains contain individual rules that can perform actions such as dropping a packet, moving to the next rule, or perform a jump to a new chain.įrom a user point of view, nftables adds a new tool, called nft, which replaces all other tools from iptables, arptables and ebtables. It was merged into the Linux kernel in late 2013 and has been available since 2014 with kernel 3.13. Nftables was initially presented at the Netfilter Workshop 2008 in Paris, France and then released in March 2009 by long-time netfilter core team member and project lead, Patrick McHardy. nft command-line tool can display a live-log of rules that are being matched for easier ruleset debugging.Applications can subscribe to nfnetlink notifications to receive rule updates when new rules get added or removed.Transactional rule updates - all rules are applied atomically.No longer enforces overhead of implicit rule counters and address/interface matching.Support for lookup tables - no linear rule evaluation required.The most notable capabilities that nftables offers over the old iptables are:

Nftables is a new packet classification framework that aims to replace the existing iptables, ip6tables, arptables and ebtables facilities. It aims to resolve a lot of limitations that exist in the venerable ip/ip6tables tools.

Iptables chains