# iptables

15 Hacker News commenters recommended iptables and 22 criticized it, November 2025 to November 2026. It was recommended in 7 of 13 months.

**Verdict:** Linux firewall tool people use for routers, bot blocking and rate limiting. Critics find its chain and table syntax confusing and say nftables is faster and better.

## Why people recommend it

- Easier to work with (2 comments): "It's not like iptables was any better, but it was more intuitive as it spoke about IPs and ports" ([source](https://news.ycombinator.com/item?id=46309570)) "I find iptables much easier to work with." ([source](https://news.ycombinator.com/item?id=45953707))
- Quick router and bot blocking (3 comments): "I've always made my own routers by using low-power devices running linux with iptables and now NFtables." ([source](https://news.ycombinator.com/item?id=47574408)) "Even easier, just throw together some iptables rules & install dnsmasq." ([source](https://news.ycombinator.com/item?id=47506906)) "It's far from perfect, but it was a quick way to get rid of bots" ([source](https://news.ycombinator.com/item?id=49211916))
- Traffic inspection and rate limiting (2 comments): "inspecting all HTTP port 80 traffic (with iptables or others)" ([source](https://news.ycombinator.com/item?id=46728733)) "use iptables rules to rate-limit any TCP network service" ([source](https://news.ycombinator.com/item?id=49667189))

## What people warn about

- Confusing syntax with chains and tables (3 comments): "I don't think there is any defense for the strange syntax of IPtables, the chains, the tables." ([source](https://news.ycombinator.com/item?id=46051230)) "the PF firewall in OpenBSD was superior, definitely to the syntax of IPtables" ([source](https://news.ycombinator.com/item?id=48193679)) "It was ending up as the normal iptables mess until I asked myself" ([source](https://news.ycombinator.com/item?id=47533033))
- Slower than newer alternatives (2 comments): "on a 16 core EC2 instance with a 10Gbps connection IPtables couldn't do more than 5Gbps of throughput" ([source](https://news.ycombinator.com/item?id=45823989)) "everyone is still using the slower iptables" ([source](https://news.ycombinator.com/item?id=45823750))
- Users moving to nftables (3 comments): "At this point I rather doubt the sanity of people still sticking to iptables tbh." ([source](https://news.ycombinator.com/item?id=47575143)) "I'll pick nftables over iptables any day, it's leagues better" ([source](https://news.ycombinator.com/item?id=47574863)) "I'm just glad we don't have to deal with iptables anymore" ([source](https://news.ycombinator.com/item?id=46847975))

## Alternatives hackers recommend

- [pf (OpenBSD Packet Filter)](https://hackerapproved.com/p/pf.md): 53 recommend
- [nftables](https://hackerapproved.com/p/nftables.md): 29 recommend
- [LuLu firewall](https://hackerapproved.com/p/lulu.md): 27 recommend
- [UFW](https://hackerapproved.com/p/ufw.md): 12 recommend
- [firewalld](https://hackerapproved.com/p/firewalld.md): 11 recommend

## Cite as

Hacker Approved, "iptables", https://hackerapproved.com/p/iptables/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).