nftables Firewall Configuration: Migrating from iptables on Ubuntu

If you manage Bare Metal Servers, you've probably noticed that iptables is being phased out in favor of nftables. If you're running Ubuntu 24.04 LTS or Debian 12, you're already using nftables under the hood through a compatibility layer called iptables-nft.

This guide covers how to move your firewall rules to native nftables syntax and avoid locking yourself out during the switch.

Why Migrate?

• Unified IPv4/IPv6: The new inet table covers both protocol families.
• Native sets: You can group IPs or ports into a set (tcp dport { 22, 80, 443 } accept).
• Performance: Rulesets are compiled to bytecode, which is significantly faster at scale.

Step 1: Export Your Existing Ruleset

Save your current rules as a safety net:

bash
sudo iptables-save > ~/iptables-backup-$(date +%F).rules
sudo ip6tables-save > ~/ip6tables-backup-$(date +%F).rules

Step 2: Translate iptables Rules
nftables ships with translation utilities that provide an excellent starting point:

sudo apt install nftables
iptables-restore-translate -f ~/iptables-backup-$(date +%F).rules

Or translate rule-by-rule:

Bash
iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT
Step 3: Write a Native Configuration
Here is a baseline for a server running SSH and web services in /etc/nftables.conf:

Plaintext
#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Allow established/related and loopback
        ct state established,related accept
        iif "lo" accept

        # Drop invalid packets
        ct state invalid drop

        # Allow SSH, HTTP, HTTPS
        tcp dport { 22, 80, 443 } accept
    }
}
Step 4: Test and Persist
Test the ruleset (keep a second SSH session open in case you lock yourself out!):

Bash
sudo nft -f /etc/nftables.conf
Enable it to persist across reboots:

Bash
sudo systemctl enable --now nftables
To learn about rolling back in emergencies and how local firewalls pair with hardware edge protection, read the full tutorial here: https://www.eservers.uk/tutorials/howto/migrate-iptables-to-nftables-ubuntu-debian/