Definition and purpose
nftables is the modern Linux kernel framework for packet filtering, stateful firewall rules and network address translation.
Technical operation
Rules are grouped into tables, chains and sets. Base chains attach to packet-processing hooks such as input, forward, output, prerouting and postrouting, each with a priority and policy. The nft utility sends rule-set changes to the kernel.
Practical example
An HTTPS server may allow established flows and new TCP connections on port 443 while denying other unsolicited incoming traffic. Test remote-access rules before enabling a deny-by-default policy.
Operational considerations
Avoid conflicting firewall managers. Keep emergency console access, save persistent configurations, and verify IPv4, IPv6, NAT and forwarding behavior.