Notes on nftables for people who learned iptables

I put off moving to nftables for years because my iptables rules worked. Then I had to maintain the same firewall on six machines and the copy-paste finally got to me.

Sets are the whole point

Instead of one rule per address, keep a named set and match against it:

set admin_v4 {
  type ipv4_addr
  flags interval
  elements = { 192.168.2.0/24, 100.64.0.0/10 }
}

tcp dport 22 ip saddr @admin_v4 accept

The ordering mistake

Chains with the same hook run in priority order, and an accept in one base chain does not skip the others. I lost an hour to a Docker chain that happily dropped what my own chain had accepted.

Atomic reloads

nft -f applies a whole file as one transaction. Start the file with flush ruleset and you never sit half-configured.