iptables to nftables Converter

iptables is the legacy Linux firewall built on the xtables framework, with a separate command for each protocol (iptables, ip6tables, arptables, ebtables) and a fixed set of tables and chains. nftables is its modern replacement: a single command (nft) with a unified syntax that handles IPv4, IPv6, ARP, and bridge traffic in one ruleset. Under the hood, nftables uses a virtual machine in the kernel that compiles your rules into bytecode, which is faster and more flexible than xtables. It also adds first-class support for sets, maps, named counters, intervals, and atomic ruleset reloads, features that required iptables-restore tricks or external tools like ipset before.

Yes, but with caveats. The two frameworks both attach to netfilter hooks, so they coexist at the kernel level. Packets traverse rules from both in priority order. On modern distros, the iptables command is usually iptables-nft, a compatibility shim that writes nftables rules under the hood, which avoids most conflicts. The legacy iptables-legacy binary uses the old xtables backend and runs in parallel, which can cause confusing behavior because rules from each backend are invisible to the other. The recommended path is to pick one: either run pure nftables, or stick with the iptables-nft compatibility layer until you migrate. Mixing iptables-legacy and nftables on a production firewall is a debugging nightmare best avoided.

Yes. Debian made nftables the default backend in Debian 10 (Buster) in 2019, and Ubuntu followed in 20.04 LTS. On both distros, the iptables package now installs iptables-nft by default, so existing scripts that call iptables continue to work, but the rules end up in the nftables kernel subsystem, not the legacy xtables one. You can confirm this with iptables -V, which shows (nf_tables) in the version string. RHEL/CentOS/Rocky 8+ and Fedora 32+ also default to nftables, typically managed through firewalld which uses nftables as its backend.

Run iptables -V. If the output ends with (nf_tables), the iptables command is the nftables-backed shim and your rules live in nftables. If it ends with (legacy), you are on the original xtables backend. You can also list active nftables rules directly with sudo nft list ruleset; if it returns content, nftables is in use. Finally, lsmod | grep nf_tables shows whether the kernel module is loaded. On systemd-based distros, systemctl status nftables tells you whether the persistent ruleset service is enabled.

For typical rulesets with a handful of rules, the difference is imperceptible. nftables shows clear performance wins once your ruleset grows, especially with hundreds or thousands of address/port matches, because it uses sets and maps with O(log n) lookups instead of iptables' linear chain traversal. nftables also has lower per-packet overhead in its bytecode VM than xtables' module-by-module dispatch, and it supports flowtable offload for established connections that bypasses the normal rule walk entirely. The bigger practical wins are usually maintainability: atomic reloads, named sets you can update without rewriting rules, and a single syntax across IPv4 and IPv6.