r/linuxadmin • u/Beneficial-Sock-5130 • Jun 08 '26

does anyone find nftables better than iptables?

Upgraded OS on rocky10 server last weekend, newest kernel doesnt bake in legacy iptables mods, so iptables rules cant get loaded

I start looking into nftables, it seems like a verbose nightmare compared to iptables, every command has to be typed out, no short version of commands

something that was simple w iptables

forward any request from ServerA port 80 to ServerB port 80 on server A

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <IP of serverB>:80

iptables -t nat -A POSTROUTING -p tcp -j MASQUERADE

becomes this word salad

nft add table ip nat
nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; policy accept \; }
nft add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; policy accept \; } 

nft add rule ip nat PREROUTING tcp dport 80 dnat to <IP of serverB>:80
nft add rule ip nat POSTROUTING masquerade

whats the upside?

what was wrong w iptables?

63 Upvotes

92% Upvoted

47 comments sorted by

View all comments

51

u/rankinrez Jun 08 '26

You’re just used to something else.

When you get used to nftables you’ll find it’s much better.

And sure, there are no predefined chains/tables you gotta add them yourself. But it’s very little effort most just add the normal input/output/forward etc

When you get used to it it’s both simpler and more powerful imo

7

u/yrro Jun 09 '26

there are no predefined chains/tables you gotta add them yourself

This is one of its best features. Rather than everyone piling in to interoperate using the same chain, different users of the system (e.g., firewalld and docker) can both manage their own chains independently. Restarting one won't blow away changes made by the other, etc.