nft (nftables): Usage, Options & Common CI Errors
nft configures the modern nftables firewall - the successor to iptables.
nftables is the kernel firewall that replaces the legacy iptables family. nft has a different, unified syntax; mixing nft and iptables-legacy on the same host is the main source of "my rules disappeared" confusion in CI.
What it does
nft is the command-line tool for nftables, the in-kernel packet classification framework that supersedes iptables/ip6tables/arptables. A single nft ruleset holds tables, chains, and rules in one consistent syntax for both IPv4 and IPv6.
Common usage
nft list ruleset # dump the entire ruleset
nft list tables
nft add table inet filter
nft 'add chain inet filter input { type filter hook input priority 0; }'
nft add rule inet filter input tcp dport 8080 dropOptions
| Subcommand | What it does |
|---|---|
| list ruleset | Print the entire active ruleset |
| list tables / list table <fam> <name> | Show tables / one table |
| add table <family> <name> | Create a table (ip, ip6, inet, ...) |
| add chain ... | Create a chain with a hook and priority |
| add rule ... | Append a rule |
| flush ruleset | Remove everything |
Common errors in CI
"Error: Could not process rule: Operation not permitted" - nft needs CAP_NET_ADMIN; run privileged or --cap-add=NET_ADMIN. "Error: syntax error, unexpected ..." comes from iptables-style syntax leaking into nft - they are not compatible; nft uses tcp dport 80 drop, not -A/--dport. The big trap: a host using iptables-nft and a tool using legacy iptables write to different rule stores, so list ruleset may not show rules you "added" - standardize on one backend. flush ruleset wipes ALL firewalling, including Docker's, so avoid it on shared runners.