The nftables package provides user-space tools to control the Linux nftables subsystem.

A service that loads the rules from /etc/nftables.d can be enabled with:

rc-update add nftables boot
rc-service nftables start

The default rules shipped will block all incoming connections.

Packaged Rules

Note: This section describes changes that are still being implemented and subject to change

Many packages with server software are accompanied by an -nftables package which include the typical default rules to expose the server.

For example, openssh-nftables will open the default port used by openssh (i.e.: TCP port 22).

To enable these rules, they must be symlinked in nftable's configuration directory. E.g.:

ln -s /usr/share/nftables.avail/sshd.nft /etc/nftables.d/sshd.nft

See also