The successor to iptables: on Debian 12 and later it is the default firewall. A single rule set covers both IPv4 and IPv6 (the inet family) and the whole ruleset is loaded atomically from a file.
Commands
command purpose
nft list ruleset print the current rules
nft -f /etc/nftables.conf load the config from file
nft monitor watch changes live
Tables and chains
table chains
inet filter input, forward, output – basic filtering
ip nat prerouting, postrouting – address translation
NAT – masquerade
Outbound traffic from the internal network gets the address of the outbound interface wan0:
table ip nat {
chain postrouting {
type nat hook postrouting priority 100;
oifname "wan0" masquerade
}
}