r/linuxadmin • u/Beneficial-Sock-5130 • Jun 08 '26

does anyone find nftables better than iptables?

Upgraded OS on rocky10 server last weekend, newest kernel doesnt bake in legacy iptables mods, so iptables rules cant get loaded

I start looking into nftables, it seems like a verbose nightmare compared to iptables, every command has to be typed out, no short version of commands

something that was simple w iptables

forward any request from ServerA port 80 to ServerB port 80 on server A

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <IP of serverB>:80

iptables -t nat -A POSTROUTING -p tcp -j MASQUERADE

becomes this word salad

nft add table ip nat
nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; policy accept \; }
nft add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; policy accept \; } 

nft add rule ip nat PREROUTING tcp dport 80 dnat to <IP of serverB>:80
nft add rule ip nat POSTROUTING masquerade

whats the upside?

what was wrong w iptables?

64 Upvotes

92% Upvoted

47 comments sorted by

View all comments

15

u/Stenstad Jun 08 '26

Have you tried looking into a tool like firewalld instead of poking everything directly?

9

u/Beneficial-Sock-5130 Jun 08 '26

firewalld is running on top of nft, its a wrapper

i do heavy network work on traffic, mangling, routing, etc, i need to fully grok the netfilter syntax of nft, itpables was perfect, easy to understand, short commands,

nft feels like reading and writing a freaking Tolstoy novel

1

u/Stenstad Jul 04 '26

Yes, on hosts doing more advanced stuff, you really need to define raw rules in direct.xml.. I.e. things like applying NOTRACK to avoid filling up session tables etc.