# nftables

29 Hacker News commenters recommended nftables and 10 criticized it, November 2025 to November 2026. It was recommended in 8 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Linux firewall tool people prefer over iptables for readable, atomic rulesets and easy configuration files. Common caveat: the syntax is hard to learn and the documentation lags behind pf.

## Why people recommend it

- Readable and easy to configure (6 comments): "nftables is readable and easy to grok especially after you rip out the iptables stuff" ([source](https://news.ycombinator.com/item?id=46312087)) "it's easy to learn, effective and if you know it you know everything about firewalls" ([source](https://news.ycombinator.com/item?id=46321626)) "Linux has nftables nowadays, which is much nicer and easier to configure." ([source](https://news.ycombinator.com/item?id=45947989))
- Clearly better than iptables (6 comments): "At this point I rather doubt the sanity of people still sticking to iptables tbh." ([source](https://news.ycombinator.com/item?id=47575143)) "Linux has nftables nowadays, which is much nicer and easier to configure." ([source](https://news.ycombinator.com/item?id=45947989)) "I'll pick nftables over iptables any day, it's leagues better" ([source](https://news.ycombinator.com/item?id=47574863))
- Built into kernel, standard everywhere (3 comments): "The biggest benefit is that it doesn't require any non-standard tooling." ([source](https://news.ycombinator.com/item?id=49307905)) "nftables has been in the kernel for over a decade" ([source](https://news.ycombinator.com/item?id=45823750)) "nftables is standard pretty much everywhere." ([source](https://news.ycombinator.com/item?id=49141450))
- Effective at blocking spammers and bots (2 comments): "a nftables firewall seutp to rate limit spammers, and this seems to help a lot" ([source](https://news.ycombinator.com/item?id=46611432)) "keeps a lot of beyond poorly written bots away" ([source](https://news.ycombinator.com/item?id=48908973))

## What people warn about

- Steep learning curve and tough syntax (4 comments): "I hate that nftables is the brand new thing with entirely different syntax to learn again" ([source](https://news.ycombinator.com/item?id=46042567)) "With nftables you need to learn a lot before you cam be partially sure of wbat you do." ([source](https://news.ycombinator.com/item?id=46317589)) "nftables syntax is pretty tough to read" ([source](https://news.ycombinator.com/item?id=47574579))
- Missing features like ipset (3 comments): "so I tried nftables, and that went down a rabbit hole that made me wish iptables and ipset weren't being replaced" ([source](https://news.ycombinator.com/item?id=47540682)) "I've found that sets are insufficiently powerful and maps are insufficiently well-documented." ([source](https://news.ycombinator.com/item?id=47585301)) "that capability does not exist at least natively in nftables" ([source](https://news.ycombinator.com/item?id=46294813))
- Documentation and UX lag behind pf (2 comments): "Forget iptables/NFT's documentatiton on par of PF." ([source](https://news.ycombinator.com/item?id=47414594)) "it's still far from the UX I get from pf" ([source](https://news.ycombinator.com/item?id=46316768))
- Improvement over iptables is modest (2 comments): "Nftables has improved the situation on Linux somewhat" ([source](https://news.ycombinator.com/item?id=46038578)) "nftables does not seem to be an improvement at all." ([source](https://news.ycombinator.com/item?id=47577791))

## Alternatives hackers recommend

- [pf (OpenBSD Packet Filter)](https://hackerapproved.com/p/pf.md): 53 recommend
- [LuLu firewall](https://hackerapproved.com/p/lulu.md): 27 recommend
- [iptables](https://hackerapproved.com/p/iptables.md): 15 recommend
- [UFW](https://hackerapproved.com/p/ufw.md): 12 recommend
- [firewalld](https://hackerapproved.com/p/firewalld.md): 11 recommend

## Cite as

Hacker Approved, "nftables", https://hackerapproved.com/p/nftables/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).