Netfilter and nftables are frameworks in Linux that provide advanced network filtering and firewall management capabilities. They are responsible for packet filtering, network address translation (NAT), and packet mangling. Netfilter is the older framework, while nftables is the newer and more flexible framework that replaced iptables.
Netfilter operates by intercepting incoming and outgoing network packets at the network stack and performing actions based on predefined rules. The rules are stored in chains, which are sequences of rules that define how packets should be filtered or modified. Each chain is associated with a table, which is a collection of chains with similar purposes. There are several tables, such as the filter table, the nat table, and the mangle table, which correspond to different aspects of packet processing.
On the other hand, nftables is a more modern and flexible replacement for Netfilter. It provides a simplified syntax for defining rules and filters, and allows for greater flexibility in terms of defining chains and tables. It also supports additional protocols and provides better performance than Netfilter.
Here’s an example of how to use nftables to set up a firewall rule to allow incoming SSH connections:
sudo nft add rule filter input tcp dport 22 acceptThis command adds a rule to the input chain of the filter table to accept incoming TCP packets with a destination port of 22 (SSH).
Overall, both netfilter and nftables are powerful tools for managing network filtering and firewall rules in Linux, with nftables being the newer and more flexible option.