iptables and nftables

Netfilter chains (INPUT/OUTPUT/FORWARD/PREROUTING/POSTROUTING), tables (filter/nat/mangle), rule evaluation order, and nft syntax.

Overview

Overview iptables and nftables are the primary tools for configuring the Linux kernel's packet filtering framework, Netfilter. Every major Linux firewall, container networking system, and cloud hypervisor ultimately uses Netfilter under the hood — Docker, Kubernetes (kube-proxy), and UFW all write iptables rules or nftables rules.

Netfilter uses the concept of tables and chains. The filter table handles allow/drop decisions. The nat table handles Network Address Translation (SNAT, DNAT, masquerade). The mangle table modifies packet headers (TTL, DSCP, marks). The raw table is evaluated first and can exempt packets from connection tracking.

Within each table, chains represent hook points in the packet processing path. The INPUT chain processes packets destined for the local machine. The OUTPUT chain processes packets originating from the local machine. The FORWARD chain processes packets being routed through the machine. The PREROUTING chain is evaluated before routing decisions — this is where DNAT happens. The POSTROUTING chain is evaluated after routing decisions — this is where SNAT and masquerade happen.

Rules within a chain are evaluated sequentially from top to bottom. The first matching rule applies its target (ACCEPT, DROP, REJECT, LOG, DNAT, SNAT, RETURN, a user-defined chain). If no rule matches, the chain's default policy applies.

nftables replaced iptables as the default in most Linux distributions starting around kernel 5.2. nftables has a cleaner syntax, a single binary (nft) replacing iptables/ip6tables/arptables/ebtables, atomic rule replacement, and better performance for large rulesets.

Key concepts

Tables: Groups of chains organized by function. filter: allow/drop. nat: address translation. mangle: packet header modification. raw: connection tracking exemption. Each table has its own set of valid chains.
Chains: Ordered lists of rules evaluated at a specific hook point. Built-in chains: INPUT (to local), OUTPUT (from local), FORWARD (through), PREROUTING (before routing), POSTROUTING (after routing). User-defined chains act as subroutines.
Rule evaluation order: Rules are evaluated top-to-bottom. The first matching rule applies its target. No further rules are checked after a terminal target (ACCEPT, DROP, REJECT). RETURN exits a user-defined chain back to the calling chain.
Connection tracking (conntrack): Netfilter tracks the state of TCP connections and UDP sessions. States: NEW, ESTABLISHED, RELATED, INVALID. Stateful rules use -m conntrack --ctstate ESTABLISHED,RELATED to allow return traffic.
DNAT and SNAT: DNAT (Destination NAT) changes the destination IP/port. Applied in PREROUTING. Used for port forwarding. SNAT changes the source IP. Applied in POSTROUTING. MASQUERADE is SNAT using the outgoing interface's IP automatically.
nftables: The successor to iptables. Uses a single binary (nft), supports atomic rule replacement, has set and map data structures for efficient matching, and handles IPv4, IPv6, ARP, and bridge filtering in one framework.

When to use it

Debugging connectivity issues caused by firewall rules on a Linux server or container host
Writing firewall rules to restrict inbound/outbound traffic on an EC2 instance or on-premises server
Understanding how Docker and Kubernetes (kube-proxy) use iptables for NAT and service routing
Migrating a server from iptables to nftables
Implementing port forwarding (DNAT) for a service exposed through a Linux router

Interview questions

Walk through how iptables processes a packet and explain the table and chain evaluation order.
Write a minimal iptables ruleset for a web server that allows SSH, HTTP, HTTPS, and established traffic, and drops everything else.
How does Docker use iptables, and why should you never flush all iptables rules on a Docker host?

iptables and nftables

Overview

Key concepts

When to use it

Interview questions

More Networking topics