How to Install nftables on Ubuntu 26.04 and 24.04

To install nftables on Ubuntu 26.04 or 24.04, use APT to install the Ubuntu package. nftables controls network traffic using rules in the Linux kernel.

This guide checks the existing firewall, then shows a small host firewall, persistence and removal. If you need help, leave a comment or contact us.

To install nftables, refresh the package list and install the package:

sudo apt update
sudo apt install nftables

Installing the package is separate from applying a firewall policy. Before starting the nftables service or changing active rules, inspect the existing firewall and read the precautions below.

1. Check the Existing Firewall

Installing the package and activating a firewall are separate tasks. A ruleset is the collection of active nftables tables and rules. Inspect the host before changing either the service or its configuration:

sudo nft list ruleset
sudo ufw status verbose
sudo systemctl status nftables --no-pager
sudo ss -ltnp

If nft is not installed yet, its first command may say it was not found; continue with installation and run it again. UFW may also be absent. The listening socket list helps identify SSH and other services, but check your SSH server configuration and provider firewall too. An existing SSH session may remain connected even when new connections are blocked.

Stop before applying the example if you find existing firewall rules, an active UFW or another rule manager, or if you cannot identify how the host is protected. Container and VPN software can manage rules even when UFW is inactive. Ubuntu advises against mixing native nftables rules with UFW or iptables-based managers. If you use UFW, see our UFW firewall commands guide instead. Do not disable UFW remotely as a shortcut; plan a migration with console access.

2. Install and Verify nftables

nft --version
sudo nft list ruleset

Do not start, stop, restart or enable the service yet. Ubuntu’s packaged /etc/nftables.conf can contain flush ruleset, which removes all nftables rules when loaded, including rules created by other software. The service stop action can also flush the entire ruleset. Inspect the unit, the file and every included file first:

sudo cat /etc/nftables.conf
sudo systemctl cat nftables

If the configuration contains include directives, open the referenced files and any nested includes too. Do not overwrite a configuration you do not understand.

3. Create a Small Host Firewall

The following optional example is for a dedicated host with no existing firewall rules or firewall manager. It allows loopback, established connections, ICMP and new SSH connections, then drops other inbound traffic. It does not filter forwarded or outgoing traffic; other firewall rules and system settings may still affect them. It is not a router or container firewall.

sudo cp -an /etc/nftables.conf /etc/nftables.conf.before-uf-guide
sudo ls -l /etc/nftables.conf.before-uf-guide

sudo nano /etc/nftables.conf

table inet uf_guard
flush table inet uf_guard

table inet uf_guard {
    chain input {
        type filter hook input priority filter; policy drop;
        iifname "lo" accept
        ct state established,related accept
        ct state invalid drop
        ip protocol icmp accept
        meta l4proto ipv6-icmp accept
        tcp dport 22 accept
    }
}

The inet table applies to IPv4 and IPv6. ICMP is allowed for connectivity and network error messages, including IPv6 neighbor discovery. The first two lines create the named table if needed and clear its rules when reloading; they do not flush the entire ruleset. Every other incoming port is dropped by this chain. Review IPv6 exposure as well as IPv4.

sudo nft -c -f /etc/nftables.conf

sudo nft -f /etc/nftables.conf
sudo nft list ruleset

In the output, look for table inet uf_guard, its input chain and policy drop, followed by the rules you configured. This confirms what is listed, not that SSH works or that other firewall layers are correct.

Keep the original session open. From a second terminal or another computer, establish a new SSH connection using the real host and port. Test required services over both address families where applicable. If the test fails, use the recovery console below. Do not enable persistence until access works.

4. Allow a Web Service

If this host actually serves HTTP and HTTPS, add the following line inside the input chain, before its closing brace. Opening a port exposes a listening service to reachable networks; use only the ports you need:

tcp dport { 80, 443 } accept

Save the file, run sudo nft -c -f /etc/nftables.conf, then apply it with sudo nft -f /etc/nftables.conf only if the check succeeds. Verify the service from another machine and test a new SSH login again. Other firewall layers can still block traffic even when this chain accepts it.

5. Keep Rules After a Restart

Once the example works and the saved configuration has been reviewed, enable the service for future boots:

sudo systemctl enable nftables.service
systemctl is-enabled nftables.service

The service loads /etc/nftables.conf at boot. Enabling it does not itself apply the file now; the previous step did that. On a later reboot, verify the active rules and test a new connection. Ensure no other service changes the firewall during boot. Direct nft commands change the running rules only; edit and reload the saved file to make intended changes persistent.

Troubleshooting and Recovery

Recovery for this example only: From the local or provider console, remove the tutorial table and disable its boot service. This removes the example firewall protection, so restore a suitable firewall promptly. Do not use these commands if another configuration owns the table or service:

sudo nft delete table inet uf_guard
sudo systemctl disable nftables.service

Deleting uf_guard removes this example from the running rules immediately. Disabling the service prevents its automatic start at boot; disabling it alone does not remove active rules. Check access using a fresh SSH connection while keeping the console or original session open.

To restore persistent protection, inspect the saved configuration and any included files, correct the SSH port and required services, and check the intended file with sudo nft -c -f /etc/nftables.conf. With recovery access ready, apply the reviewed policy, test a fresh SSH connection and required services, and only then re-enable boot loading or reboot. A backup of a config file does not recreate other managers’ rules. Avoid nft flush ruleset: it removes all nftables tables, including rules belonging to other software.

Update or Remove nftables

To receive Ubuntu package updates, refresh the package list and upgrade the package:

sudo apt update
sudo apt install --only-upgrade nftables

Before removal, arrange and verify replacement protection if needed. Restrict the following removal steps to the dedicated example host. Package removal can stop the nftables service, whose stop action may flush the entire nftables ruleset, including rules managed by other software. On shared hosts, plan removal with the administrator and inspect the service unit first. On the dedicated example host, use the recovery commands above to remove the example table and disable boot loading. Confirm what remains with sudo nft list ruleset; do not delete tables owned by other software.

apt -s remove nftables

sudo apt remove nftables

Helpful Resources

Read the Ubuntu nftables documentation and the nftables atomic rule replacement guide.

Frequently Asked Questions

Related guides: Install Ubuntu Server | Install a LAMP stack | Install a LEMP stack.