nftables vs iptables on Ubuntu 22.04: which to use and practical examples

By Kevin Marcondes · Published on Oct 28, 2026 · 8 min read

This comparison shows, in practical terms, when to use nftables or iptables for firewalls on Ubuntu 22.04. You’ll see architectural differences, pros and cons, selection criteria by scenario, equivalent command examples to configure basic rules, and a safe migration checklist.

What changes in Ubuntu 22.04: backend and compatibility

On Ubuntu 22.04, iptables commands use the nf_tables backend by default (iptables-nft). iptables-legacy remains available via update-alternatives for compatibility. Avoid mixing different backends on the same server.

You can check which backend is active and switch if necessary. Changes may affect existing tools and scripts. Plan a maintenance window and ensure console access to avoid losing connection.

# Verificar backend atual
iptables -V  # deve exibir (nf_tables) quando usa iptables-nft

# Listar e alternar implementations (requer sudo)
sudo update-alternatives --list iptables
sudo update-alternatives --config iptables
sudo update-alternatives --list ip6tables
sudo update-alternatives --config ip6tables

Comparison table: operational criteria that matter

Summary of the points that most affect firewall operation, maintenance and evolution in production. Use as a quick checklist before deciding.

Decision criteria by scenario (no dogma)

There’s no single right answer. Consider your operations, team and tooling. Below are practical criteria that usually determine the choice.

• New installation on Ubuntu 22.04: prefer nftables. Unified syntax, atomic loads and sets simplify maintenance.
• Critical, stable inherited scripts: stick with iptables (or iptables-nft) while preparing a controlled migration.
• Environments with many dynamic IPs/ports: nftables with sets and maps tends to simplify and scale better.
• Team strongly familiar with iptables and the change is sensitive: continue with iptables-nft, but standardize and avoid mixing backends.
• Using UFW: the default backend on 22.04 is nftables; align your decision with established policies.
• Observability and auditing: nftables offers 'nft monitor'; with iptables, standardize on 'iptables-save' and kernel logs.

Practical example with nftables (Ubuntu 22.04)

Example policy: block incoming, allow outgoing, open SSH (22/tcp), HTTP (80/tcp) and HTTPS (443/tcp), accept established traffic and ICMP/ICMPv6. Warning: applying rules may terminate your SSH session; use console access or a second test session.

/etc/nftables.conf will be the single source of truth and the nftables service keeps rules across boot.

# Limpar e aplicar configuração nftables (Ubuntu 22.04)
sudo nft flush ruleset
sudo tee /etc/nftables.conf >/dev/null <<'EOF'
table inet filter {
  sets {
    allowed_tcp_ports = { type inet_service; elements = { 22, 80, 443 } }
  }
  chains {
    input {
      type filter hook input priority 0; policy drop;
      ct state established,related accept
      iif lo accept
      ct state invalid drop
      ip protocol icmp accept
      ip6 nexthdr icmpv6 accept
      tcp dport @allowed_tcp_ports accept
    }
    forward { type filter hook forward priority 0; policy drop; }
    output  { type filter hook output  priority 0; policy accept; }
  }
}
EOF

# Validar sintaxe e aplicar
sudo nft -c -f /etc/nftables.conf && sudo nft -f /etc/nftables.conf

# Persistir no boot
sudo systemctl enable --now nftables

# Ver ruleset carregado
sudo nft list ruleset

Equivalent practical example with iptables (legacy)

The rules below implement the same policy using iptables and ip6tables. On 22.04, commands work even with iptables-nft. To use pure legacy, switch the alternative to iptables-legacy. Test outside critical hours and keep recovery access.

# Limpar regras atuais
sudo iptables -F && sudo iptables -X
sudo ip6tables -F && sudo ip6tables -X

# Políticas padrão
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Regras básicas
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
sudo iptables -A INPUT -p icmp -j ACCEPT
sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
sudo iptables -A INPUT -p tcp -m multiport --dports 22,80,443 -j ACCEPT

# Persistir no boot (salva v4 e v6)
sudo apt-get update && sudo apt-get install -y iptables-persistent
sudo netfilter-persistent save

# Conferir
sudo iptables -S
sudo ip6tables -S

Safe migration from iptables to nftables (translate and test)

The safest path is to translate current rules, validate, test in staging or a controlled window, and only then enable at boot. Take snapshots/backups before changing a production firewall.

Use translate tools to get a starting point and adjust for the inet table. Validate with 'nft -c' and have a rollback plan.

# Exportar regras atuais
sudo iptables-save > /tmp/rules.v4
sudo ip6tables-save > /tmp/rules.v6

# Traduzir para sintaxe nftables (gera base inicial)
sudo iptables-restore-translate -f /tmp/rules.v4 > /tmp/translated-v4.nft
sudo ip6tables-restore-translate -f /tmp/rules.v6 > /tmp/translated-v6.nft

# Opcional: mesclar/ajustar para uma única table inet em /etc/nftables.conf
# Validação e aplicação de teste
sudo nft -c -f /etc/nftables.conf && sudo nft -f /etc/nftables.conf

# Habilitar no boot
sudo systemctl enable --now nftables

Integration with UFW, Fail2ban and SSH access

If you use UFW on 22.04, its backend is nftables. Avoid managing nftables manually and using UFW at the same time to prevent conflicting rules. Centralize rule management in one layer.

Fail2ban provides actions for both nftables and iptables; choose the one that matches your active backend.

When hardening rules, protect your access: a bastion, port knocking or 2FA reduce the risk of lockout, especially in multi-user environments.

• UFW guide with basic steps: see How to Set Up a Firewall on Ubuntu with UFW.
• Fail2ban with alerts: check fail2ban webhooks & Telegram on Ubuntu 22.04.
• Harden SSH: use a bastion as in Set up an SSH Bastion on Ubuntu 22.04.

Monitoring and troubleshooting firewall rules

To diagnose, inspect the loaded ruleset, netfilter events and per-rule counters. Enable drop logs when needed. With iptables, use listings with counters and check listening sockets.

Avoid blind changes. Validate with '-c', use parallel sessions and set an automatic rollback when possible.

# nftables: ruleset, eventos e logs de serviço
sudo nft list ruleset
sudo nft monitor
sudo journalctl -u nftables -b

# iptables: regras com contadores
sudo iptables -L -n -v
sudo ip6tables -L -n -v

# Portas em escuta/ligação
ss -lntupe | head

When each option is better (actionable summary)

Use nftables on new installs, when you want unified IPv4/IPv6 rules, atomic application and sets for large lists. Use iptables (or iptables-nft) when legacy scripts are critical and the team needs immediate continuity, while planning a gradual migration.

In either case, standardize the backend, document flows and automate rule application to reduce errors. See also the VPS Linux security checklist.

Frequently asked questions

Does nftables replace iptables on Ubuntu 22.04?

nftables is the kernel's modern framework. On Ubuntu 22.04, iptables binaries use the nf_tables backend by default (iptables-nft). iptables-legacy remains available for compatibility, but the recommendation for new configurations is to adopt nftables.

Can I use iptables and nftables at the same time?

Avoid mixing backends. You can use iptables-nft (a compatibility front) on top of nf_tables or adopt nft directly, but don't mix with iptables-legacy on the same host. Standardize the backend and tooling to prevent conflicting rules.

How do I tell if my iptables uses the nftables backend?

Run 'iptables -V': if it shows '(nf_tables)', you're using iptables-nft. You can also check and switch with 'update-alternatives --list|--config iptables' and the equivalent for ip6tables. Make changes only in controlled windows.

Does UFW use nftables or iptables on 22.04?

On Ubuntu 22.04, UFW uses the nftables backend. You can use it as a higher-level layer for common rules, but avoid administering nftables and UFW manually on the same server.

Is ipset still necessary with nftables?

Generally no. nftables has native sets and maps with good performance. In classic iptables, ipset remains useful for large lists. When migrating to nftables, restructure lists as sets to simplify matching rules.

See also

• ZFS vs LVM+LUKS on VPS for Databases — snapshots, performance and post-failure recovery
• Practical comparison — Nginx Unit vs PHP‑FPM vs RoadRunner for PHP monoliths in containers — latency, throughput & memory
• ZFS vs Btrfs for Snapshots, Replication and Incremental Retention on VPS with Docker — Practical Pros and Cons
• Flyway vs Liquibase vs Sqitch: database versioning for PHP/Laravel projects