{"slug": "iptables", "name": "iptables", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 1, "commenters": 6, "warners": 2, "score": -0.121, "rising": -0.33, "first": "2025-11-24", "latest": "2026-08-01", "why": "I\u2019ve always made my own routers by using low-power devices running linux with iptables and now NFtables.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 3, "compare": 0, "warn": 2}, "spark": [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "I\u2019ve always made my own routers by using low-power devices running linux with iptables and now NFtables.", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["iptables"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 761190528, "item_id": 47574408, "url": "https://news.ycombinator.com/item?id=47574408", "by": "louwrentius", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve always made my own routers by using low-power devices running linux with iptables and now NFtables.", "excerpt": "A router only really needs one network interface. Any computer with a single network interface, maybe a laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. I\u2019ve always made my own routers by using low-power devices running linux with iptab", "context": "builds own routers", "use_case": "DIY router firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 786240150, "item_id": 49140009, "url": "https://news.ycombinator.com/item?id=49140009", "by": "ninefathom", "date": "2026-08-01", "stance": "warn", "quote": "I find iptables / nftables overly complex and counterintuitive for most \"daily driver\" firewall purposes", "excerpt": "Presently in my home you'll find Debian, Alpine, and Manjaro Linux installations running almost constantly (plus Android if you wish to be pedantic), each for their various niches. You'll also find more esoteric stuff like OpenVMS/VAX 7.3 (on actual VAX hardware), Mac OS 7.5.5 and 9.2.2 and 10.4.11 (each on their native hardware as well), and occasionally 9front or Haiku or QNX or OpenIndiana for various purposes. Th", "context": "", "use_case": "firewall", "switched_from": "", "story": "NetBSD 11.0 Released"}, {"id": 736607409, "item_id": 46037963, "url": "https://news.ycombinator.com/item?id=46037963", "by": "guerby", "date": "2025-11-24", "stance": "warn", "quote": "I never liked iptables", "excerpt": "We migrated to a linux nftables based firewall. I never liked iptables, but nftables is pretty nice to write and use. And with one \"flowtable\" line added to your nftables.conf you can even in theory have faster routing when conntrack is active https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath", "context": "", "use_case": "firewall", "switched_from": "", "story": "Moving from OpenBSD to FreeBSD for firewalls"}]}], "who": [{"by": "drnick1", "context": "uses an old gaming PC as a router", "url": "https://news.ycombinator.com/item?id=47577973", "date": "2026-03-30"}, {"by": "louwrentius", "context": "builds own routers", "url": "https://news.ycombinator.com/item?id=47574408", "date": "2026-03-30"}, {"by": "p0w3n3d", "context": "iptables user", "url": "https://news.ycombinator.com/item?id=46309489", "date": "2025-12-17"}], "tags": [], "use_cases": ["firewall", "firewall/nat on home router", "diy router firewall", "firewall rules with ipsets", "firewall configuration"], "compared": [{"slug": "nftables", "name": "nftables", "co": 5, "switched_from": 0, "switched_to": 2}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47574034", "title": "How to Turn Anything into a Router", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49136736", "title": "NetBSD 11.0 Released", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46524390", "title": "I Cannot SSH into My Server Anymore (and That's Fine)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46305585", "title": "I got hacked: My Hetzner server started mining Monero", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45980474", "title": "Moving from OpenBSD to FreeBSD for firewalls", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 1}, "2025-12": {"neutral": 1}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {"recommend": 1, "neutral": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"warn": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 786240150, "item_id": 49140009, "url": "https://news.ycombinator.com/item?id=49140009", "by": "ninefathom", "date": "2026-08-01", "stance": "warn", "quote": "I find iptables / nftables overly complex and counterintuitive for most \"daily driver\" firewall purposes", "excerpt": "Presently in my home you'll find Debian, Alpine, and Manjaro Linux installations running almost constantly (plus Android if you wish to be pedantic), each for their various niches. You'll also find more esoteric stuff like OpenVMS/VAX 7.3 (on actual VAX hardware), Mac OS 7.5.5 and 9.2.2 and 10.4.11 (each on their native hardware as well), and occasionally 9front or Haiku or QNX or OpenIndiana for various purposes. Th", "context": "", "use_case": "firewall", "switched_from": "", "story": "NetBSD 11.0 Released"}, {"id": 761247568, "item_id": 47577973, "url": "https://news.ycombinator.com/item?id=47577973", "by": "drnick1", "date": "2026-03-30", "stance": "neutral", "quote": "run dozens of services on it besides the firewall/NAT (iptables)", "excerpt": "> While it may seem appealing, I would highly recommend against installing loads of software right on the router, and instead forward traffic to a device in a DMZ or VLAN. Why not? I use an old gaming PC as a \"router\" (machine exposed to the WAN), and run dozens of services on it besides the firewall/NAT (iptables). Among others: email, Web server, multiple game servers, and many internal services (DNS, hostapd, load", "context": "uses an old gaming PC as a router", "use_case": "firewall/NAT on home router", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 761190528, "item_id": 47574408, "url": "https://news.ycombinator.com/item?id=47574408", "by": "louwrentius", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve always made my own routers by using low-power devices running linux with iptables and now NFtables.", "excerpt": "A router only really needs one network interface. Any computer with a single network interface, maybe a laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. I\u2019ve always made my own routers by using low-power devices running linux with iptab", "context": "builds own routers", "use_case": "DIY router firewall", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 745321585, "item_id": 46582599, "url": "https://news.ycombinator.com/item?id=46582599", "by": "ValdikSS", "date": "2026-01-11", "stance": "neutral", "quote": "iptables is using new netfilter (I'm not using iptables-legacy)", "excerpt": ">perf is a shell tool. iptables is a shell tool. sshguard is a log reader and ultimately you will use the CLI to take action. Well yes, and to be honest in this case I did that all over SSH: run `perf`, generate flame graph, copy the .svg to the PC over SFTP, open it in the file viewer. What I really wanted is a web interface which will just show me EVERYTHING it knows about the system in a form of charts, graphs, so", "context": "", "use_case": "firewall rules with ipsets", "switched_from": "", "story": "I Cannot SSH into My Server Anymore (and That's Fine)"}, {"id": 740951825, "item_id": 46309489, "url": "https://news.ycombinator.com/item?id=46309489", "by": "p0w3n3d", "date": "2025-12-17", "stance": "neutral", "quote": "As a user of iptables this order makes me anxious.", "excerpt": "$ sudo ufw default deny incoming $ sudo ufw default allow outgoing $ sudo ufw allow ssh $ sudo ufw allow 80/tcp $ sudo ufw allow 443/tcp $ sudo ufw enable As a user of iptables this order makes me anxious. I used to cut myself out from the server many times because first blocking then adding exceptions. I can see that this is different here as the last command commits the rules...", "context": "iptables user", "use_case": "firewall configuration", "switched_from": "", "story": "I got hacked: My Hetzner server started mining Monero"}, {"id": 736607409, "item_id": 46037963, "url": "https://news.ycombinator.com/item?id=46037963", "by": "guerby", "date": "2025-11-24", "stance": "warn", "quote": "I never liked iptables", "excerpt": "We migrated to a linux nftables based firewall. I never liked iptables, but nftables is pretty nice to write and use. And with one \"flowtable\" line added to your nftables.conf you can even in theory have faster routing when conntrack is active https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath", "context": "", "use_case": "firewall", "switched_from": "", "story": "Moving from OpenBSD to FreeBSD for firewalls"}]}