iptables
Ranked 4 of 8 firewalls by recommenders
Linux firewall tool people use for routers, bot blocking and rate limiting. Critics find its chain and table syntax confusing and say nftables is faster and better.
Linux firewall tool people use for routers, bot blocking and rate limiting. Critics find its chain and table syntax confusing and say nftables is faster and better.
37 people gave an opinion
- recommend it
- 15
- criticize it
- 22
- approval share
- 41%
Recommended in 7 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 15 people recommend itNeeds 10 or more, met.
- 0.6 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Easier to work with
“It's not like iptables was any better, but it was more intuitive as it spoke about IPs and ports”
Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” “I find iptables much easier to work with.”
Comment from 17 Nov 2025 in “Why use OpenBSD?” Quick router and bot blocking
“I've always made my own routers by using low-power devices running linux with iptables and now NFtables.”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router” “Even easier, just throw together some iptables rules & install dnsmasq.”
Comment from 24 Mar 2026 in “FCC Updates Covered List to Include Foreign-Made Consumer Routers” “It's far from perfect, but it was a quick way to get rid of bots”
Comment from 7 Aug 2026 in “99% of My Website Traffic Is Bots” Traffic inspection and rate limiting
“inspecting all HTTP port 80 traffic (with iptables or others)”
Comment from 23 Jan 2026 in “Captive Wi-Fi” “use iptables rules to rate-limit any TCP network service”
Comment from 12 Sep 2026 in “DeCloudflare”
What people warn about
Each mark is one comment
Confusing syntax with chains and tables
“I don't think there is any defense for the strange syntax of IPtables, the chains, the tables.”
Comment from 25 Nov 2025 in “Moving from OpenBSD to FreeBSD for firewalls” “the PF firewall in OpenBSD was superior, definitely to the syntax of IPtables”
Comment from 19 May 2026 in “OpenBSD 7.9 Released” “It was ending up as the normal iptables mess until I asked myself”
Comment from 26 Mar 2026 in “My home network observes bedtime with OpenBSD and pf” Slower than newer alternatives
“on a 16 core EC2 instance with a 10Gbps connection IPtables couldn't do more than 5Gbps of throughput”
Comment from 5 Nov 2025 in “An eBPF loophole: Using XDP for egress traffic” “everyone is still using the slower iptables”
Comment from 5 Nov 2025 in “An eBPF loophole: Using XDP for egress traffic” Users moving to nftables
“At this point I rather doubt the sanity of people still sticking to iptables tbh.”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router” “I'll pick nftables over iptables any day, it's leagues better”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router” “I'm just glad we don't have to deal with iptables anymore”
Comment from 1 Feb 2026 in “The Book of PF, 4th edition”
Other firewalls people recommend
The four most recommended other firewalls, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| pf (OpenBSD Packet Filter) | 53 | 7 | 88% | 11 | — | Approved |
| nftables | 29 | 10 | 74% | 8 | — | Approved |
| LuLu firewall | 27 | 3 | 90% | 9 | — | Approved |
| iptablesThis page | 15 | 22 | 41% | 7 | — | — |
| UFW | 12 | 15 | 44% | 6 | — | — |
What people said
34 of the 38 comments that mention it, newest first. Each links to the original comment.
“use iptables rules to rate-limit any TCP network service”
“It's far from perfect, but it was a quick way to get rid of bots”
“IPTables is just terrible”
“the PF firewall in OpenBSD was superior, definitely to the syntax of IPtables”
“dont use individual rules in iptables”
“the only thing that's better with nftables are sets and maps”
“iptables is terse but logical.”
“Definitely an upgrade over iptables.”
“At this point I rather doubt the sanity of people still sticking to iptables tbh.”
“I'll pick nftables over iptables any day, it's leagues better”
“I've always made my own routers by using low-power devices running linux with iptables and now NFtables.”
“It was ending up as the normal iptables mess until I asked myself”
“Even easier, just throw together some iptables rules & install dnsmasq.”
“that didnt really safely work”
“Forget iptables/NFT's documentatiton on par of PF.”
“I'm just glad we don't have to deal with iptables anymore”
“inspecting all HTTP port 80 traffic (with iptables or others)”
“how apparently inefficient source/destination address hashing algorithm for the set match is”
“iptables is sooo last decade”
“Even iptables rules turned out to not be a very good approach since most destinations would have many, constantly cycling IPs and ports.”
“after you rip out the iptables stuff”
“UFW and Firewall-CMD both just use iptables in that context though.”
“With iptables, it was painful”
“It's not like iptables was any better, but it was more intuitive as it spoke about IPs and ports”
“As a user of iptables this order makes me anxious.”
“I don't think there is any defense for the strange syntax of IPtables, the chains, the tables.”
“You had ipchains, iptables, nftables and now god knows what.”
“Compared to working with iptables, PF is like this haiku”
“Consider the featureset of iptables”
“I find iptables much easier to work with.”
“iptables is indeed horrid”
“by blocking an entire /16 range, it is this type of overzealous action that contributes to making the internet experience a bit more mediocre”
“on a 16 core EC2 instance with a 10Gbps connection IPtables couldn't do more than 5Gbps of throughput”
“everyone is still using the slower iptables”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.