Debian Firewall Management With nftables and iptables

Debian relies on the modern nftables framework as its default packet-filtering backend while maintaining backward compatibility with the legacy iptables toolset. This article explains how Debian integrates nftables by default, how the compatibility layer bridges older syntax, how to verify or switch the active firewall system, and how native rules are structured and managed.

The Shift to nftables as the Default Backend

Starting with Debian 10 (Buster) and continuing through modern releases, Debian replaced the legacy iptables framework with nftables as the default Linux packet-filtering engine. The Linux kernel's netfilter subsystem powers both tools, but nftables consolidates IPv4, IPv6, ARP, and Ethernet filtering into a single unified framework with higher performance, atomic rule updates, and cleaner syntax.

The Compatibility Layer: iptables-nft

To avoid breaking existing scripts, security tools, and administrator workflows, Debian does not simply remove the iptables commands. Instead, it provides a compatibility layer called iptables-nft.

When an administrator runs commands like iptables, ip6tables, ebtables, or arptables, Debian directs these commands to translation binaries. These tools accept standard iptables syntax, translate the directives into nftables bytecode, and inject them directly into the nftables kernel subsystem. This allows legacy scripts and orchestration software to function without modification.

Managing Firewall Alternatives

Debian manages the relationship between legacy utilities and nftables through the update-alternatives system. By default, the symlinks point to the *-nft variants rather than the *-legacy variants.

To inspect the current active backend for iptables, run:

update-alternatives --display iptables

If legacy behavior is strictly required for compatibility with specific legacy software, administrators can switch backends using:

sudo update-alternatives --config iptables

The system will prompt you to select either iptables-nft (the default) or iptables-legacy. Debian maintains equivalent alternatives for ip6tables, arptables, and ebtables.

Native nftables Configuration

While the compatibility layer works automatically, Debian allows administrators to bypass legacy abstractions and configure nftables natively.

The primary configuration file for native firewall rules is located at:

/etc/nftables.conf

A minimal native rule set typically defines an inet table (which handles both IPv4 and IPv6 simultaneously) and sets default policies for incoming, forward, and outgoing traffic:

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        # Accept loopback traffic
        iif "lo" accept

        # Accept established and related connections
        ct state established,related accept

        # Allow incoming SSH
        tcp dport 22 accept
    }
    chain forward {
        type filter hook forward priority filter; policy drop;
    }
    chain output {
        type filter hook output priority filter; policy accept;
    }
}

To enable and run native nftables at boot, execute:

sudo systemctl enable --now nftables

High-Level Firewall Frontends

Debian also supports higher-level management frontends such as ufw (Uncomplicated Firewall) and firewalld. When installed on modern Debian installations, these utilities detect the underlying environment and interface directly with nftables or route their rules through the iptables-nft compatibility layer, ensuring standard firewall behavior across the system.