nftables
Hacker ApprovedRanked 2 of 8 firewalls by recommenders
Linux firewall tool people prefer over iptables for readable, atomic rulesets and easy configuration files. Common caveat: the syntax is hard to learn and the documentation lags behind pf.
Linux firewall tool people prefer over iptables for readable, atomic rulesets and easy configuration files. Common caveat: the syntax is hard to learn and the documentation lags behind pf.
39 people gave an opinion
- recommend it
- 29
- criticize it
- 10
- approval share
- 74%
Recommended in 8 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 29 people recommend itNeeds 10 or more, met.
- 2.9 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 8 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Readable and easy to configure
“nftables is readable and easy to grok especially after you rip out the iptables stuff”
Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” “it's easy to learn, effective and if you know it you know everything about firewalls”
Comment from 19 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” “Linux has nftables nowadays, which is much nicer and easier to configure.”
Comment from 16 Nov 2025 in “Why use OpenBSD?” - Comment from 19 Dec 2025 in “I got hacked: My Hetzner server started mining Monero”
- Comment from 24 Nov 2025 in “Moving from OpenBSD to FreeBSD for firewalls”
- Comment from 23 Dec 2025 in “I got hacked: My Hetzner server started mining Monero”
Clearly better than iptables
“At this point I rather doubt the sanity of people still sticking to iptables tbh.”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router” “Linux has nftables nowadays, which is much nicer and easier to configure.”
Comment from 16 Nov 2025 in “Why use OpenBSD?” “I'll pick nftables over iptables any day, it's leagues better”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router” - Comment from 14 Jul 2026 in “How the FSF sysadmins block botnets with reaction”
- Comment from 30 Mar 2026 in “How to Turn Anything into a Router”
- Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero”
Built into kernel, standard everywhere
“The biggest benefit is that it doesn't require any non-standard tooling.”
Comment from 15 Aug 2026 in “I close SSH port 22 (and what I use instead)” “nftables has been in the kernel for over a decade”
Comment from 5 Nov 2025 in “An eBPF loophole: Using XDP for egress traffic” “nftables is standard pretty much everywhere.”
Comment from 2 Aug 2026 in “NetBSD 11.0 Released” Effective at blocking spammers and bots
“a nftables firewall seutp to rate limit spammers, and this seems to help a lot”
Comment from 14 Jan 2026 in “We can't have nice things because of AI scrapers” “keeps a lot of beyond poorly written bots away”
Comment from 14 Jul 2026 in “How the FSF sysadmins block botnets with reaction”
What people warn about
Each mark is one comment
Steep learning curve and tough syntax
“I hate that nftables is the brand new thing with entirely different syntax to learn again”
Comment from 25 Nov 2025 in “Moving from OpenBSD to FreeBSD for firewalls” “With nftables you need to learn a lot before you cam be partially sure of wbat you do.”
Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” “nftables syntax is pretty tough to read”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router” - Comment from 22 Nov 2025 in “Self-hosting a NAT Gateway”
Missing features like ipset
“so I tried nftables, and that went down a rabbit hole that made me wish iptables and ipset weren't being replaced”
Comment from 27 Mar 2026 in “My minute-by-minute response to the LiteLLM malware attack” “I've found that sets are insufficiently powerful and maps are insufficiently well-documented.”
Comment from 31 Mar 2026 in “How to Turn Anything into a Router” “that capability does not exist at least natively in nftables”
Comment from 16 Dec 2025 in “Confuse some SSH bots and make botters block you” Documentation and UX lag behind pf
“Forget iptables/NFT's documentatiton on par of PF.”
Comment from 17 Mar 2026 in “I Love FreeBSD” “it's still far from the UX I get from pf”
Comment from 18 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” Improvement over iptables is modest
“Nftables has improved the situation on Linux somewhat”
Comment from 24 Nov 2025 in “Moving from OpenBSD to FreeBSD for firewalls” “nftables does not seem to be an improvement at all.”
Comment from 30 Mar 2026 in “How to Turn Anything into a Router”
Other firewalls people recommend
The four most recommended other firewalls, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| pf (OpenBSD Packet Filter) | 53 | 7 | 88% | 11 | — | Approved |
| nftablesThis page | 29 | 10 | 74% | 8 | — | Approved |
| LuLu firewall | 27 | 3 | 90% | 9 | — | Approved |
| iptables | 15 | 22 | 41% | 7 | — | — |
| UFW | 12 | 15 | 44% | 6 | — | — |
What people said
39 of the 43 comments that mention it, newest first. Each links to the original comment.
“The biggest benefit is that it doesn't require any non-standard tooling.”
“nftables is standard pretty much everywhere.”
“AFAIK, Nftables is more performant, and IMO simpler”
“keeps a lot of beyond poorly written bots away”
“stuff like postgres, redis, ntftables, complex linux binaries that are hard to run need to work”
“I've found that sets are insufficiently powerful and maps are insufficiently well-documented.”
“nftables does not seem to be an improvement at all.”
“you miss out on things like atomic application of rulesets”
“nft applies configs atomically. It also has very good tracing/debugging features”
“Sticking to a minimal Debian base with nftables is often much cleaner”
“Definitely an upgrade over iptables.”
“At this point I rather doubt the sanity of people still sticking to iptables tbh.”
“I'll pick nftables over iptables any day, it's leagues better”
“nftables syntax is pretty tough to read”
“I've always made my own routers by using low-power devices running linux with iptables and now NFtables.”
“so I tried nftables, and that went down a rabbit hole that made me wish iptables and ipset weren't being replaced”
“I find nftables to be frankly less challenging than pf”
“Forget iptables/NFT's documentatiton on par of PF.”
“nft will take care of aggregating these into continouus blocks”
“I've never been a fan of having a command that just inserted or deleted a policy instead of working from a configuration file.”
“a nftables firewall seutp to rate limit spammers, and this seems to help a lot”
“look into nft - iptables is sooo last decade”
“nftables is readable and easy to grok”
“for a simple whitelist it's extremely easy to configure and modify”
“it's easy to learn, effective and if you know it you know everything about firewalls”
“With nftables you need to learn a lot before you cam be partially sure of wbat you do.”
“it's still far from the UX I get from pf”
“nftables is readable and easy to grok especially after you rip out the iptables stuff”
“It is so much nicer than iptables.”
“I find just using nftables.conf straightforward enough that I don't really understand the need for anything additional”
“that capability does not exist at least natively in nftables”
“You had ipchains, iptables, nftables and now god knows what.”
“I hate that nftables is the brand new thing with entirely different syntax to learn again”
“Nftables has improved the situation on Linux somewhat”
“nftables is pretty nice to write and use.”
“Or if nft is too complicated”
“nftables has many benefits.”
“Linux has nftables nowadays, which is much nicer and easier to configure.”
“nftables has been in the kernel for over a decade”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.