nftables Rule Generator
Generate nftables rules from CSV
Rule Definitions
nftables Configuration
Enter rules to generate nftables configuration
The nftables Rule Generator creates modern Linux firewall rules from structured CSV input using nftables syntax. Enter rules as CSV rows with table family, chain, source, destination, protocol, port, and action columns, and get either individual nft commands or a complete ruleset file that can be loaded atomically -- the recommended approach for current Linux distributions including Debian 10+, RHEL 8+, and Ubuntu 20.04+.
Understanding nftables
If you are setting up a firewall on a modern Linux distribution, nftables is the tool you should be using. It replaced iptables as the default packet filtering framework starting with the Linux 3.13 kernel, and all major distributions now ship with nftables as the default backend. Debian, Ubuntu, RHEL, Fedora, and Arch Linux all use nftables under the hood, even when you run iptables commands (the iptables-nft compatibility layer translates them automatically).
The most important advantage of nftables over iptables is atomic ruleset loading. With iptables, each rule is a separate command that modifies the live kernel state -- so if your script fails halfway through, you end up with a partial ruleset that might have security gaps. nftables lets you write your entire configuration in a single file and load it in one operation with nft -f. If any rule has a syntax error, the entire load fails and nothing changes. This atomic behavior eliminates the "half-loaded firewall" problem that has caused real security incidents with iptables.
The second major improvement is cleaner syntax for common patterns. In iptables, matching multiple ports requires the awkward -m multiport --dports 80,443,8080 extension. In nftables, you write tcp dport { 80, 443, 8080 } -- a simple set that reads like a natural expression. The inet family lets you write one rule that applies to both IPv4 and IPv6 instead of maintaining separate iptables and ip6tables configurations. Named sets let you define a group of addresses once and reference it in multiple rules. These features reduce configuration complexity and make firewall rules easier to read during audits.
How to Generate nftables Rules from CSV
- Prepare your rule data in CSV format with columns: table family, chain, source, destination, protocol, port(s), and action.
- Paste or upload the CSV into the generator.
- Choose the output format: individual
nftcommands or a complete ruleset file. - The generator produces nftables syntax leveraging features like sets, maps, and the
inetfamily. - Copy the output and load it with
nft -f ruleset.nftfor atomic application.
CSV Input Format and Generated Rules
CSV Input
family,chain,source,destination,protocol,port,action
inet,input,203.0.113.0/24,,tcp,22,drop
inet,input,10.0.0.0/8,,tcp,443,accept
inet,input,,,tcp,80,accept
inet,output,,198.51.100.10,tcp,3306,accept
inet,forward,192.168.1.0/24,10.0.0.0/8,tcp,8080,accept
Generated Ruleset File
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ip saddr 203.0.113.0/24 tcp dport 22 drop
ip saddr 10.0.0.0/8 tcp dport 443 accept
tcp dport 80 accept
}
chain output {
type filter hook output priority 0; policy accept;
ip daddr 198.51.100.10 tcp dport 3306 accept
}
chain forward {
type filter hook forward priority 0; policy drop;
ip saddr 192.168.1.0/24 ip daddr 10.0.0.0/8 tcp dport 8080 accept
}
}
Generated Individual Commands
nft add table inet filter
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
nft add rule inet filter input ip saddr 203.0.113.0/24 tcp dport 22 drop
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 443 accept
nft add rule inet filter input tcp dport 80 accept
nftables Features Used by the Generator
| Feature | nftables Syntax | iptables Equivalent |
|---|---|---|
| Multiple ports | tcp dport { 80, 443, 8080 } | -m multiport --dports 80,443,8080 |
| Port range | tcp dport 8000-8080 | --dport 8000:8080 |
| Multiple sources | ip saddr { 10.0.0.0/8, 172.16.0.0/12 } | Two separate rules |
| Dual-stack (inet) | table inet filter | Separate iptables and ip6tables rules |
| Named sets | set blocklist { type ipv4_addr; } | No equivalent |
| Logging | log prefix "SSH: " drop | Separate -j LOG and -j DROP rules |
When to Use the nftables Rule Generator
- New server deployments -- Modern distributions ship with nftables as default; start with nftables syntax from the beginning.
- iptables migration -- Convert existing iptables rules to nftables when upgrading to Debian 10+, RHEL 8+, or Ubuntu 20.04+.
- Atomic ruleset loading -- Unlike iptables (rule-by-rule), nftables can load an entire ruleset atomically with
nft -f, eliminating gaps during configuration changes. - Infrastructure as Code -- Generate nftables rulesets from CSV/spreadsheet data for version-controlled, repeatable firewall configurations.
- Dual-stack simplification -- Use the
inetfamily to write one rule that applies to both IPv4 and IPv6 instead of maintaining separate rulesets.
How nftables Differs from iptables
Table Families
nftables organizes rules by family, which determines what traffic the table processes:
inet-- Handles both IPv4 and IPv6 (most common choice)ip-- IPv4 onlyip6-- IPv6 onlyarp-- ARP protocolbridge-- Bridge-level filtering
Sets and Maps
nftables supports inline anonymous sets and named reusable sets:
# Anonymous set -- multiple values in one rule
tcp dport { 22, 80, 443 } accept
# Named set -- reusable across rules
set trusted_nets {
type ipv4_addr
flags interval
elements = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 }
}
ip saddr @trusted_nets accept
Atomic Loading
The generator can produce a complete ruleset file that replaces the entire configuration in a single operation:
nft -f /etc/nftables.conf # Load entire ruleset atomically
nft list ruleset # Verify the active rules
Practical Advice for nftables Configuration
If you are migrating from iptables, resist the temptation to simply translate rules one-to-one. nftables has features that let you express the same policy with far fewer rules. Take the opportunity to consolidate: merge multiple port-specific rules into set-based rules, combine IPv4 and IPv6 rules using the inet family, and replace chains of LOG-then-DROP with single log prefix "..." drop statements. A migration is the perfect time to audit and simplify your firewall policy, not just transliterate it.
For production servers, always store your nftables configuration in /etc/nftables.conf and enable the nftables systemd service with systemctl enable nftables. This ensures your rules are loaded at boot. Unlike iptables where you need a separate persistence mechanism (iptables-persistent on Debian, iptables-services on RHEL), nftables persistence is built into the standard service unit file. After making changes, run nft -c -f /etc/nftables.conf to check syntax without applying, then reload with systemctl restart nftables.
When debugging nftables rules, the nft list ruleset command is your best friend. It shows the complete active configuration exactly as the kernel sees it, including rule counters that tell you how many packets each rule has matched. If a rule counter stays at zero, either no matching traffic has arrived or a rule higher in the chain is catching the traffic first. Use nft monitor for real-time logging of rule matches, which is invaluable when troubleshooting why specific traffic is being dropped.
Frequently Asked Questions
Can I run iptables and nftables at the same time?
Technically both use the same kernel netfilter framework, but running both simultaneously causes conflicts. The iptables-nft compatibility layer translates iptables commands to nftables internally, but mixing native nftables rules with iptables commands is not recommended.
How do I persist nftables rules across reboots?
Save your ruleset to /etc/nftables.conf and enable the nftables systemd service: systemctl enable nftables. The service loads the ruleset file on boot.
What is the inet family and should I always use it?
The inet family processes both IPv4 and IPv6 traffic in a single table, eliminating the need for duplicate rules. Use inet for most configurations. Use ip or ip6 only when you need address-family-specific behavior.
How do I migrate from iptables to nftables?
Use the iptables-save command to export your current rules, then run them through iptables-restore-translate (part of the iptables-nft package) to get an nftables equivalent. Review the output carefully -- automated translation produces functional but non-idiomatic nftables. Use this generator to build clean nftables rules from scratch when possible.
What is the performance difference between iptables and nftables? nftables uses an optimized virtual machine in the kernel for rule evaluation, which is generally faster than iptables for complex rulesets. The improvement is most noticeable with large rulesets (hundreds of rules) and set-based matching. For simple configurations with a dozen rules, the difference is negligible.
Can I use nftables on older kernels? nftables requires Linux kernel 3.13 or later. Basic features work from 3.13, but advanced features like maps and concatenated sets require 4.1+. All current LTS distributions include sufficiently recent kernels.
Related Tools
- iptables Rule Generator - Generate iptables rules from CSV for legacy Linux systems
- Rule Conflict Finder - Find duplicate, shadowed, or overlapping firewall rules
- Allowlist Builder - Build minimal CIDR allowlist from IP list
- Blocklist Builder - Build minimal CIDR blocklist from IP list
- Azure NSG Rule Generator - Generate Azure NSG rules from CSV