How to block suspicious traffic and attacks with nftables

Why replace iptables with nftables for server security

When managing servers exposed to the public internet, packet filtering serves as the first line of defense against malicious probes, brute-force bots, and unwanted traffic. For many years, iptables was the undisputed standard in the Linux ecosystem for this task. However, its legacy architecture suffered from kernel code duplication and performance bottlenecks under heavy network loads. nftables arrives as the modern evolution, unifying network subsystems into a flexible, high-performance framework.

In practice, nftables optimizes how the kernel evaluates network rules by utilizing generic tables and hash-indexed data sets. Before applying filtering rules to the edge infrastructure, engineers often validate network integrity and route visibility using diagnostic tools such as how to inspect routes and ARP tables on Linux with ip route to ensure legitimate traffic continues flowing without unexpected packet drops.

Basic structure and modern syntax of nftables

The architecture of nftables discards the rigid fixed tables of iptables and adopts a model based on user-defined tables, chains, and rules. A table in nftables belongs to a specific protocol family, such as inet, which simultaneously covers both IPv4 and IPv6 traffic, drastically simplifying security rule maintenance.

To create a new table and a basic input filtering chain, we utilize the nft command-line utility. The example below demonstrates how to initialize this environment cleanly, ensuring the server accepts established connections and drops everything else:

nft add table inet firewall
nft add chain inet firewall input { type filter hook input priority 0 \\; policy drop \\;
nft add rule inet firewall input ct state established,related accept
nft add rule inet firewall input iif lo accept

Advanced filtering and blocking suspicious connections

Securing a modern server requires going beyond basic accept or drop policies. With nftables, we can implement rate limiting to contain password guessing attempts on exposed services like SSH or mitigate distributed denial-of-service attacks at the network layer before they reach applications.

We can create dynamic sets that store IP addresses detected in suspicious activities through port scanning. This automated approach reduces operational overhead and protects machine compute resources against constant abuse originating from the open internet, complementing other traffic analyses such as real-time monitoring discussed in how to monitor Linux network traffic in real time with iftop.

Dynamic rules for brute-force mitigation

Brute-force attacks attempt to guess credentials by testing hundreds of combinations per minute. In nftables, we can intercept these attempts by creating a rule that monitors the packet rate per source IP and automatically adds offenders to a temporary block list.

The command below illustrates how to create a typed set to store blocked addresses and a rule that limits new connections on the remote administration port:

nft add set inet firewall blocked_ips { type ipv4_addr\\; flags interval\\; timeout 1h\\; }
nft add rule inet firewall input tcp dport 22 ct state new ip saddr @blocked_ips drop
nft add rule inet firewall input tcp dport 22 ct state new limit rate 5/minute burst 3 packets accept

Persistence and best management practices

A common mistake when configuring firewalls on Linux is applying rules directly via the command line without saving them, causing all work to be lost after a simple system reboot. To avoid unpleasant surprises, the standard configuration file is typically located at /etc/nftables.conf.

Before restarting the service or applying new rules in production, always run the syntax validation command to ensure there are no typos that could lock out administrative access to the remote server. To explore these architectural concepts further in production, see our related technical analysis on How to measure ripple and noise in linear power supplies.

Final Considerations and Secure Operation

The adoption of nftables represents a significant leap in performance, clarity, and flexibility for system administrators and network engineers. By leaving legacy complexity behind and embracing a cleaner syntax, maintaining rigorous security policies on public cloud servers becomes remarkably practical.

Remember that infrastructure security is an ongoing process of monitoring, fine-tuning, and regular connectivity testing. Combine well-structured filtering rules with frequent log audits to ensure your network edge remains resilient against evolving threats.