nftables Firewall Basics on Linux (Replace iptables)

RHEL-family distros now default to nftables instead of legacy iptables. This guide builds a minimal host firewall that drops inbound traffic except SSH and web ports.

Step 1: Install and Enable nftables

Install with dnf install nftables and enable with systemctl enable --now nftables.

Step 2: Write a Basic Ruleset

Create /etc/nftables/main.nft with an inet filter table, input chain, and policy drop.

Step 3: Load Rules and Verify

Run nft -f /etc/nftables/main.nft and check with nft list ruleset. Test SSH from another host before closing your session.

Minimal ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state established,related accept
    iif lo accept
    tcp dport { 22, 80, 443 } accept
  }
}

Related tutorials

• UFW Firewall Basics
• iptables Backup Script
• Port Monitor Script

Terminal screenshots are original illustrations created for Gnome IT Solutions (blog.gnomeitsolutions.com).