nftables vs firewalld on Ubuntu 22.04 VPS — performance, rules and practical examples

By Kevin Marcondes · Published on Oct 28, 2026 · 7 min read

Comparison: nftables vs firewalld for Ubuntu 22.04 servers on VPS — performance, rules and practical examples. This guide explains what changes in day-to-day management, when each option fits best, and how to apply equivalent configurations safely. You’ll see the operational, automation and audit impacts so you can decide with confidence.

What they are and how they relate on Ubuntu 22.04

nftables is the Linux kernel packet filtering subsystem. firewalld is a higher-level daemon that manages policies by zones and services, and on Ubuntu 22.04 it uses nftables as its backend.

Decisions to allow or block traffic are executed in the kernel dataplane (nf_tables). firewalld translates policies into nftables rules. The main difference is how you declare, version and operate rules.

If you’re starting server hardening, see the VPS Linux security checklist for complementary best practices.

• nftables: declarative syntax, sets/maps, atomic apply.
• firewalld: zones, named services, D-Bus API and CLI.
• At the dataplane level, performance is equivalent for both.

Which is faster on a VPS?

For network traffic, pure nftables and firewalld show practically equivalent performance. The kernel makes packet decisions in the same nftables subsystem. Differences appear in rule management and reload behavior.

Using nftables with a single file makes atomic applies and simple rollbacks easier. firewalld allows runtime changes and granular reloads; a complete-reload can cause a brief interruption. On typical VPS instances, the impact is usually negligible.

• Dataplane: same for both (kernel nf_tables).
• nftables: atomic apply with a versionable file.
• firewalld: runtime-friendly; complete-reload can interrupt.
• Firewall CPU/RAM usage: minimal compared to your apps.

Comparison table: when each option is better

The right choice depends on your workflow, need for zones and rule complexity. This nftables vs firewalld comparison for Ubuntu 22.04 VPS servers summarizes objective criteria to help you decide.

Which to choose for my Ubuntu 22.04 VPS?

For fine-grained control, easy versioning and sets/maps, using nftables directly often makes the most sense. For operational speed with predefined zones and services, firewalld accelerates routine work without sacrificing security.

Both protect well. The difference is in management: a single declarative file (nftables) versus commands and zones (firewalld). Integrate the chosen approach with your provisioning and continuously monitor results.

• Small teams and IaC: nftables with a versioned file.
• Operations based on zones/services: firewalld.
• IPv4 and IPv6: both handle them fully.
• Large IP lists: nftables performs better.

nftables rule examples (restrictive policy)

This example creates an inet 'filter' table with a default drop policy and allows SSH, HTTP(S), loopback, ICMP and established connections. Applying incorrect rules can drop your SSH session; keep a second session and a rollback plan.

After saving the file, apply it with 'sudo nft -f /etc/nftables.conf' and validate with 'sudo nft list ruleset'.

# /etc/nftables.conf
flush ruleset

table inet filter {
  sets {
    ssh_admins_v4 { type ipv4_addr; flags interval; elements = { 203.0.113.0/24 } }
  }
  chains {
    input {
      type filter hook input priority 0; policy drop;
      ct state established,related accept
      iif lo accept
      ip protocol icmp accept
      ip6 nexthdr icmpv6 accept
      tcp dport { 80, 443 } accept
      ip saddr @ssh_admins_v4 tcp dport 22 accept
      counter log prefix "nft-drop " flags all drop
    }
    forward { type filter hook forward priority 0; policy drop; }
    output { type filter hook output priority 0; policy accept; }
  }
}

Equivalent examples with firewalld (zones and services)

Below we configure the 'public' zone, allow HTTP/HTTPS and restrict SSH to an IPv4 block via a rich rule. Make the changes permanent and reload. If you remove wide-open SSH, test first via console/serial to avoid losing access.

For robust administrative access, consider a dedicated jump host; see how to set up an SSH bastion on Ubuntu 22.04.

sudo apt-get update && sudo apt-get install -y firewalld
sudo systemctl enable --now firewalld

# Defina a zona padrão e remova SSH amplo (se existir)
sudo firewall-cmd --set-default-zone=public
sudo firewall-cmd --permanent --remove-service=ssh || true

# Libere HTTP/HTTPS na zona padrão
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Restrinja SSH ao bloco 203.0.113.0/24
sudo firewall-cmd --permanent \
  --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" port protocol="tcp" port="22" accept'

# Aplique alterações
sudo firewall-cmd --reload

# Verifique
sudo firewall-cmd --list-all

Operating in production: versioning, rollback and audit

With nftables, versioning /etc/nftables.conf simplifies audit and rollback. Use CI/CD to run 'nft -c -f' to validate syntax before applying. With firewalld, keep idempotent playbooks and export the permanent configuration regularly.

Test in staging and validate access with health checks and logs. Reinforce perimeter controls with complementary layers like brute-force blocking and volumetric mitigation.

• Staging before production, with connectivity tests.
• Keep an extra SSH session and a planned rollback window.
• Collect logs and alerts for blocked attempts.
• Use idempotent automation to avoid configuration drift.

Common mistakes when configuring a firewall on Ubuntu 22.04 VPS

Avoiding these pitfalls saves time and prevents incidents. Review the points below before applying rules in production.

• Forgetting IPv6: protect both ip and ip6 consistently.
• Blocking SSH without a safe exception or console access.
• Not starting with a restrictive default policy (drop).
• Reloading rules without syntax checks and a rollback plan.
• Ignoring complementary layers like fail2ban and rate limits.
• Not monitoring after changes: verify ports and real traffic.

Frequently asked questions

Does nftables replace iptables on Ubuntu 22.04?

Yes. The kernel uses the nftables subsystem by default, and iptables CLIs often point to the nft backend (iptables-nft). For new deployments, focus on native nftables syntax.

Does firewalld use nftables on Ubuntu 22.04?

Yes. On Ubuntu 22.04, firewalld typically uses nftables as its backend. Packet decisions happen in the kernel; firewalld simplifies management with zones, services and a D-Bus API.

Which has better performance: pure nftables or firewalld?

Traffic performance is essentially the same because both use the same kernel dataplane. The difference lies in management and reload behavior, not packet processing.

Is it safe to reload the firewall over SSH in production?

Yes, if you keep a second session open and have a rollback plan. Validate syntax first, apply during a controlled window and test connectivity immediately after reload.

Can I combine firewalld and direct nftables rules?

You can, but prefer consistency. firewalld translates to nftables; mixing tools may cause configuration drift. If you use firewalld, prefer its rich/direct rules.

How do I ensure IPv6 coverage in the firewall?

Define policies for both IPv4 and IPv6. In nftables, use a 'table inet' with rules for ip and ip6; in firewalld, services and rich rules can be configured to operate across both families.

See also

• ZFS vs LVM+LUKS on VPS for Databases — snapshots, performance and post-failure recovery
• Practical comparison — Nginx Unit vs PHP‑FPM vs RoadRunner for PHP monoliths in containers — latency, throughput & memory
• ZFS vs Btrfs for Snapshots, Replication and Incremental Retention on VPS with Docker — Practical Pros and Cons
• Flyway vs Liquibase vs Sqitch: database versioning for PHP/Laravel projects