Netfilter Tables Cheat Sheet

This post is a cheat sheet describing some of the basic commands used to configure Netfilter Tables – nftables – using the nft
command-line utility.
Netfilter Table Structure
Netfilter tables are organized hierarchically. Tables contain chains and chains contain rules, for example:
- Table 1
- Chain 1
- Rule 1
- Rule 2
- Chain 2
- Rule 3
- Chain 1
- Table 2
- Chain 3
- Rule 4
- Chain 3
Basic Syntax
Tables, chains, and rules are set using nft
nft <command> <subcommand> <arguments ...>
Common Commands
- list
- add
- insert
- flush
- delete
Common Subcommands
- tables (plural)
- table (singular)
- chain
- rule
Examples
List all tables
$ sudo nft list tables
Add a table named “mytable”
$ sudo nft add table mytable
Add a chain to a table
The command is the the form: nft add chain <table name> <filter name> { <filter properties> }
$ sudo nft add chain mytable input { type filter hook input priority 0 \; }
Add a rule to a chain
The command is in the form: nft add rule <table name> <filter name> <rule>
This example adds a rule to our input chain in mytable to accept all network traffic from localhost.
$ sudo nft add rule mytable input iif lo accept
Remove a rule from a chain
The command is in the form: nft remove rule <table name> <filter name> handle <N>
, where N is a handle number. Since removing a rule requires knowing its handle, removing rules is a two-step process.
- Determine handle
- Enter remove rule command
Step 1: Determine the handle by listing the containing table using the -a
option.
$ sudo nft list table mytable -a
You should see output like this:
table ip filter { chain input { type filter hook input priority 0; policy accept; iif "lo" accept # handle 2 } }
Step 2: Remove the rule with handle 2.
$ sudo nft delete rule mytable input handle 2
Flush a chain
Flushing a chain removes all rules from it but leaves the chain itself, including its properties, in place. The command is in the form: nft flush chain <table name> <chain name>
$ sudo nft flush chain mytable input
Delete a chain
Note: You can only delete an empty chain, so you’ll need to flush the chain before entering the delete command.
The command is in the form: nft delete chain <table name> <chain name>
$ sudo nft delete chain mytable input
Flush a table
Flushing a table removes all chains and rules from it but leaves the table itself in place. The command is in the form: nft flush table <table name>
$ sudo nft flush table mytable
Delete a table
Deleting a table removes the table and all its contents. The command is in the form nft delete table <table name>
. Note: if your Linux kernel is earlier than 3.18, you’ll first need to flush the table before deleting it, otherwise you’ll get an error. If your kernel is 3.18 or later, you should be able to delete a table directly without flushing it.
$ sudo nft delete table mytable