{"slug": "nftables", "name": "nftables", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 4, "commenters": 8, "warners": 0, "score": 4.566, "rising": 0.02, "first": "2025-11-09", "latest": "2026-10-15", "why": "I never liked iptables, but nftables is pretty nice to write and use.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 5, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 0, 2, 0, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I never liked iptables, but nftables is pretty nice to write and use.", "icon": false, "domain": "nftables.org", "github_repo": null, "official_url": "https://netfilter.org/projects/nftables/", "pricing": "", "aliases": ["nftables"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 788926480, "item_id": 49307905, "url": "https://news.ycombinator.com/item?id=49307905", "by": "mmh0000", "date": "2026-08-14", "stance": "recommend", "quote": "I've been using nftables for port knocking for a while now.", "excerpt": "I've been using nftables for port knocking for a while now. I run an SSH tunnel server that needs to be globally accessible. But I don't want it getting hammered by bots nonstop. So, I have this nft script which works alongside Firewalld: $ systemctl enable --now nftables $ cat /etc/nftables/portknock.nft table ip portknock {} delete table ip portknock table ip portknock { set knocked { type ipv4_addr flags timeout t", "context": "runs a globally accessible SSH tunnel server", "use_case": "port knocking for SSH", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 761421616, "item_id": 47588851, "url": "https://news.ycombinator.com/item?id=47588851", "by": "0xCMP", "date": "2026-03-31", "stance": "recommend", "quote": "I used the nftables Wiki to learn all the basics I know about nft", "excerpt": "I used the nftables Wiki to learn all the basics I know about nft: https://wiki.nftables.org/wiki-nftables/index.php/Main_Page Here is their example relevant to the current article: https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_home_router", "context": "", "use_case": "firewall / home router", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 761190529, "item_id": 47574408, "url": "https://news.ycombinator.com/item?id=47574408", "by": "louwrentius", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve always made my own routers by using low-power devices running linux with iptables and now NFtables.", "excerpt": "A router only really needs one network interface. Any computer with a single network interface, maybe a laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. I\u2019ve always made my own routers by using low-power devices running linux with iptab", "context": "builds own routers", "use_case": "DIY router firewall", "switched_from": "iptables", "story": "How to Turn Anything into a Router"}, {"id": 736607408, "item_id": 46037963, "url": "https://news.ycombinator.com/item?id=46037963", "by": "guerby", "date": "2025-11-24", "stance": "recommend", "quote": "I never liked iptables, but nftables is pretty nice to write and use.", "excerpt": "We migrated to a linux nftables based firewall. I never liked iptables, but nftables is pretty nice to write and use. And with one \"flowtable\" line added to your nftables.conf you can even in theory have faster routing when conntrack is active https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath", "context": "", "use_case": "Linux firewall", "switched_from": "iptables", "story": "Moving from OpenBSD to FreeBSD for firewalls"}]}], "caveats": [], "who": [{"by": "Bender", "context": "runs small sites", "url": "https://news.ycombinator.com/item?id=50102733", "date": "2026-10-15"}, {"by": "mmh0000", "context": "runs a globally accessible SSH tunnel server", "url": "https://news.ycombinator.com/item?id=49307905", "date": "2026-08-14"}, {"by": "louwrentius", "context": "builds own routers", "url": "https://news.ycombinator.com/item?id=47574408", "date": "2026-03-30"}, {"by": "akho", "context": "parent of a 9-year-old", "url": "https://news.ycombinator.com/item?id=45867174", "date": "2025-11-09"}], "tags": [], "use_cases": ["firewall", "blocking bot ips", "port knocking for ssh", "firewall / home router", "diy router firewall", "firewall rules against syn floods"], "compared": [{"slug": "iptables", "name": "iptables", "co": 5, "switched_from": 2, "switched_to": 0}, {"slug": "nginx", "name": "nginx", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47574034", "title": "How to Turn Anything into a Router", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50102566", "title": "One in Five Websites Blocks an AI Crawler", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49248388", "title": "I close SSH port 22 (and what I use instead)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48892859", "title": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46294456", "title": "Texas is suing all of the big TV makers for spying on what you watch", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46235750", "title": "Confuse some SSH bots and make botters block you", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1, "recommend": 1}, "2025-12": {"neutral": 2}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 2}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"neutral": 1}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {"neutral": 1}}, "quotes": [{"id": 801643729, "item_id": 50102733, "url": "https://news.ycombinator.com/item?id=50102733", "by": "Bender", "date": "2026-10-15", "stance": "neutral", "quote": "dump their IP into NFTables ipsets", "excerpt": "robots.txt does not block bots, it is just a suggestion. There are no legal teeth behind robots.txt and AI training bots can and do just ignore it. There are a myriad of methods to actually block bots, here is just one of them (and it will block Google's crawler as their http library is out of date). I use the ban variable to put them in a different access log and dump their IP into NFTables ipsets. This is mostly fo", "context": "runs small sites", "use_case": "blocking bot IPs", "switched_from": "", "story": "One in Five Websites Blocks an AI Crawler"}, {"id": 788926480, "item_id": 49307905, "url": "https://news.ycombinator.com/item?id=49307905", "by": "mmh0000", "date": "2026-08-14", "stance": "recommend", "quote": "I've been using nftables for port knocking for a while now.", "excerpt": "I've been using nftables for port knocking for a while now. I run an SSH tunnel server that needs to be globally accessible. But I don't want it getting hammered by bots nonstop. So, I have this nft script which works alongside Firewalld: $ systemctl enable --now nftables $ cat /etc/nftables/portknock.nft table ip portknock {} delete table ip portknock table ip portknock { set knocked { type ipv4_addr flags timeout t", "context": "runs a globally accessible SSH tunnel server", "use_case": "port knocking for SSH", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 782293425, "item_id": 48893339, "url": "https://news.ycombinator.com/item?id=48893339", "by": "matheusmoreira", "date": "2026-07-13", "stance": "neutral", "quote": "the nftables firewall ended up becoming the only exception", "excerpt": "> clawk forward add my-project 3000 > clawk network allow my-project api.example.com Can you describe the implementation details? How did you implement the firewall without root? I vibecoded virtdev, a virtual machine orchestration project just like this one: https://github.com/matheusmoreira/virtdev It was designed to not require root, and the nftables firewall ended up becoming the only exception. I'm very curious ", "context": "", "use_case": "firewall", "switched_from": "", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 761421616, "item_id": 47588851, "url": "https://news.ycombinator.com/item?id=47588851", "by": "0xCMP", "date": "2026-03-31", "stance": "recommend", "quote": "I used the nftables Wiki to learn all the basics I know about nft", "excerpt": "I used the nftables Wiki to learn all the basics I know about nft: https://wiki.nftables.org/wiki-nftables/index.php/Main_Page Here is their example relevant to the current article: https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_home_router", "context": "", "use_case": "firewall / home router", "switched_from": "", "story": "How to Turn Anything into a Router"}, {"id": 761190529, "item_id": 47574408, "url": "https://news.ycombinator.com/item?id=47574408", "by": "louwrentius", "date": "2026-03-30", "stance": "recommend", "quote": "I\u2019ve always made my own routers by using low-power devices running linux with iptables and now NFtables.", "excerpt": "A router only really needs one network interface. Any computer with a single network interface, maybe a laptop, can be used. Anything x86 from at least the last 10 years is energy efficient and fast enough to route at gigabit speed. The magic trick is to use VLANs, which require switches that support VLANs, which can be had for cheap. I\u2019ve always made my own routers by using low-power devices running linux with iptab", "context": "builds own routers", "use_case": "DIY router firewall", "switched_from": "iptables", "story": "How to Turn Anything into a Router"}, {"id": 741143026, "item_id": 46321439, "url": "https://news.ycombinator.com/item?id=46321439", "by": "VTimofeenko", "date": "2025-12-18", "stance": "neutral", "quote": "Firewall is based on hand-rolled nftables rules.", "excerpt": "Main data comes from unbound[1], I use vector[2] to ship and transform logs. Dnstap[3] log format IME works better than the standard logs, especially when it comes to more complex queries and replies. Undesired queries get 0.0.0.0 as a response which I track. Firewall is based on hand-rolled nftables rules. [1]: https://www.nlnetlabs.nl/projects/unbound/about/ [2]: https://vector.dev [3]: https://dnstap.info/Examples", "context": "", "use_case": "firewall", "switched_from": "", "story": "Texas is suing all of the big TV makers for spying on what you watch"}, {"id": 740825281, "item_id": 46301580, "url": "https://news.ycombinator.com/item?id=46301580", "by": "Bender", "date": "2025-12-17", "stance": "neutral", "quote": "Added a temporary rule when we encounter a syn-flood.", "excerpt": "Eventually ran out of things to play with. Actions taken: - Blackhole routed a few ASN's / data-centers. It's all spoofed packets but good to block data-centers regardless so we are not sending them syn-ack (good hygiene). - Added a temporary rule when we encounter a syn-flood. [1] End result: Input 20 packets in 17 seconds, Output syn-ack reply 20 packets in 4 minutes and 44 seconds. That should translate to an acce", "context": "", "use_case": "firewall rules against syn floods", "switched_from": "", "story": "Confuse some SSH bots and make botters block you"}, {"id": 736607408, "item_id": 46037963, "url": "https://news.ycombinator.com/item?id=46037963", "by": "guerby", "date": "2025-11-24", "stance": "recommend", "quote": "I never liked iptables, but nftables is pretty nice to write and use.", "excerpt": "We migrated to a linux nftables based firewall. I never liked iptables, but nftables is pretty nice to write and use. And with one \"flowtable\" line added to your nftables.conf you can even in theory have faster routing when conntrack is active https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath", "context": "", "use_case": "Linux firewall", "switched_from": "iptables", "story": "Moving from OpenBSD to FreeBSD for firewalls"}, {"id": 733874786, "item_id": 45867174, "url": "https://news.ycombinator.com/item?id=45867174", "by": "akho", "date": "2025-11-09", "stance": "neutral", "quote": "The laptop has nftables set up so that only an ssh connection to my laptop works", "excerpt": "I have a 9-yo. We experimented with time limits &c, but that just leads to endless discussions on the size and applicability if thise limits. Now he has a mostly-airgapped Thinkpad (with music, kiwix, music-experimantation stuff, programming things, and onlyoffice), and doesn't know the ipad's passcode. The laptop has nftables set up so that only an ssh connection to my laptop works, which I use to update it, add con", "context": "parent of a 9-year-old", "use_case": "restricting child's laptop network", "switched_from": "", "story": "Ask HN: How would you set up a child\u2019s first Linux computer?"}]}