nft list ruleset

nftables Rule Builder

Build individual nftables rules or a whole starter ruleset. Covers the stateful base every firewall needs, which is the part most examples leave out.

22, or 80,443, or 8000-8100
Blunts brute force on SSH.
Options
Generated rule
Complete starter ruleset

The three rules that must come first

With policy drop, a ruleset that only allows port 22 will still break, because replies to your own outbound traffic are not new connections and get dropped. Every working ruleset starts with ct state established,related accept, then ct state invalid drop, then accepting loopback. Get those in before anything else. And test with nft -c -f before applying: a mistake in an input chain on a remote server locks you out immediately, with no equivalent of ufw asking whether you are sure.

Generate nftables rules and a starter ruleset

This nftables rule generator builds individual rules for the inet filter table and a complete starter ruleset with stateful connection tracking already in place. It covers port sets, source and interface matching, rate limiting for brute-force resistance, logging with a prefix, and the reject versus drop distinction. nftables replaced iptables as the kernel default, and this is the syntax modern distributions actually use.

nftables FAQ

Should I learn nftables or iptables?

nftables. It is the kernel default, iptables on modern systems is usually a translation layer on top of it, and distributions have been migrating for years. Existing iptables knowledge transfers conceptually, and iptables-translate will convert individual rules for you.

What does the inet family give me over ip?

One table that handles both IPv4 and IPv6. With the older ip and ip6 families you write and maintain every rule twice, and the classic failure is a host firewalled correctly on IPv4 and wide open on IPv6. inet avoids that entirely.

How do I make rules survive a reboot?

Rules added with nft add exist only in memory. Put them in /etc/nftables.conf and enable the nftables service, or dump the running ruleset with nft list ruleset > /etc/nftables.conf once you are happy with it.

Why do my Docker containers ignore my firewall rules?

Docker inserts its own rules and publishes ports by manipulating the forward path, so a published port is reachable even when your input chain never allowed it. Bind containers to 127.0.0.1 and proxy to them, which is the reliable fix regardless of firewall.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. WireGuard Config Generator Produce matching server and peer configs with AllowedIPs, DNS, keepalive, and NAT forwarding rules. Reverse Proxy Config Builder Write nginx or Caddy config for a self-hosted service, with TLS, WebSockets, and forwarded headers. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. tcpdump Filter Builder Assemble BPF capture filters by host, port, and protocol, with rotation and Wireshark output. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. GPG Command Builder Verify signed downloads, generate keys, and sign files or git commits without guessing flags. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. ssh-keygen Builder Generate Ed25519, RSA, or FIDO2 security key SSH keys, then install them with ssh-copy-id. sudoers Rule Builder Write sudoers.d rules with run-as targets, NOPASSWD, and limited command lists, validated with visudo. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →