iptables has been the standard Linux firewall interface since kernel 2.4, and while nftables is its modern, officially-blessed successor, iptables rules still show up in countless scripts, tutorials, and production servers you’ll need to read and understand.
iptables: Chains and Tables
iptables organizes rules into chains (INPUT, OUTPUT, FORWARD) within tables (filter, nat, mangle). Rules are evaluated top to bottom, and the first match wins:
# Allow established/related connections (almost always rule #1) sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow SSH, HTTP, HTTPS sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT # Default deny everything else sudo iptables -P INPUT DROP # Persist rules across reboots sudo apt install iptables-persistent sudo netfilter-persistent save
nftables: The Modern Replacement
nftables consolidates iptables, ip6tables, arptables, and ebtables into a single framework with cleaner syntax and better performance at scale. Most modern distros (Debian, Fedora, RHEL) now use nftables under the hood even when you invoke the legacy iptables command, via a compatibility shim.
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input tcp dport {22, 80, 443} accept
# List current ruleset
sudo nft list ruleset
Which Should You Learn?
Learn nftables for anything new — it’s where the kernel firewall ecosystem is headed. But keep enough iptables fluency to read the enormous amount of existing tutorials and legacy scripts still using it; the underlying concepts (default-deny, stateful matching, ordered rules) transfer directly between both.