Skip to content
SPECIFICTION
Get listed

nftables

netfilter.org

LinuxSelf-hosted
Visit netfilter.org
Spec score 7.2 #69 of 80 in Firewall Software

Spec sheet

Purpose
nftables replaces iptables, ip6tables, arptables, and ebtables with an in-kernel packet classification framework and the nft command-line tool.Read 8 Oct 2026 · netfilter.org
Supported platforms
LinuxRead 22 Sep 2026 · netfilter.org
Free plan
YesRead 22 Sep 2026 · netfilter.org
Support
The project directs questions to mailing lists and bug reports to its tracker; it says the small core team cannot help individual users configure firewalls.Read 8 Oct 2026 · netfilter.org
License
The Netfilter licensing page describes netfilter/iptables as free software distributed under GNU GPLv2 only, with possible exceptions stated in individual source-file headers.Read 8 Oct 2026 · netfilter.org
Founded
1999Read 28 Sep 2026 · netfilter.org
Application rules
YesRead 22 Sep 2026 · netfilter.org
Compatibility
A backward compatibility layer lets users run iptables and ip6tables with the same syntax over the nftables infrastructure.Read 8 Oct 2026 · netfilter.org
Connection alerts
NoRead 22 Sep 2026 · netfilter.org
Dependencies
The nft command-line tool requires libmnl, libnftnl, and the nft tool itself to run.Read 8 Oct 2026 · netfilter.org
Documentation and support
The project points users to the nftables HOWTO, a man page, and Netfilter mailing lists.Read 8 Oct 2026 · netfilter.org
Kernel requirement
nftables is available upstream since Linux kernel 3.13, and the project recommends newer kernel versions.Read 8 Oct 2026 · netfilter.org
Library
libnftables is a high-level userspace library that includes JSON support.Read 8 Oct 2026 · netfilter.org
License and verification
The Netfilter project describes its software as free software under GNU GPLv2 or later and says its core team signs project releases with a PGP key.Read 8 Oct 2026 · netfilter.org
Maintainers
The Netfilter Core Team makes project decisions, has commit access to the master source control tree, and can make releases.Read 8 Oct 2026 · netfilter.org
Netfilter integration
nftables reuses Netfilter’s hook infrastructure, connection tracking system, NAT, userspace queueing, and logging subsystem.Read 8 Oct 2026 · netfilter.org
Network functions
The project documentation lists packet matching, rate limiting, counters, logging, NAT, load balancing and userspace queueing among its capabilities.Read 8 Oct 2026 · wiki.nftables.org
Outbound control
advancedRead 22 Sep 2026 · netfilter.org
Performance
Maps and concatenations can reduce the number of rule inspections needed to determine a packet's action.Read 8 Oct 2026 · netfilter.org
Performance feature
Maps and concatenations can structure rulesets to reduce the number of rule inspections needed to determine a packet’s action.Read 8 Oct 2026 · netfilter.org
Release downloads
The releases page offers source tarballs with GPG signatures and SHA-256 checksums; it lists nftables 1.1.7 dated 2026-Sep-01.Read 8 Oct 2026 · netfilter.org
Release security
The Netfilter Core Team says it uses a PGP key to sign all software released by the project; the listed key is valid until October 12, 2028.Read 8 Oct 2026 · netfilter.org
Rule direction
bothRead 22 Sep 2026 · netfilter.org
Rule processing
The nft tool compiles rulesets into VM bytecode for the kernel and decompiles retrieved bytecode back into ruleset form.Read 8 Oct 2026 · netfilter.org
Ruleset processing
The nft command-line tool compiles rulesets into VM bytecode for the kernel and decompiles retrieved bytecode back into ruleset form.Read 8 Oct 2026 · netfilter.org
Syntax
nftables provides unified, consistent syntax across supported protocol families, and its syntax differs from the iptables family of tools.Read 8 Oct 2026 · netfilter.org

Where Specifiction places it

Alternatives to nftablesAll alternatives →