nftables rule builder

Quick reference

1. Load a preset for a starting point, or start blank.

2. Click quick-add service buttons to insert rules with default ports — edit ports as needed.

3. Rules are evaluated top to bottom, first match wins. Reorder with ↑↓.

4. Fields turn red on validation errors. Invalid rules are skipped in output.

5. Copy or download the generated commands. Run as root or save to /etc/nftables.conf.

Port syntax: single (22), range (1024-65535), or comma-separated (80,443).
Address syntax: IPv4 (10.0.0.1), CIDR (192.168.0.0/16).
Import: paste output of sudo nft list ruleset to load existing rules.
Default policy: controls the chain policy for input and forward chains. drop (recommended) silently drops unmatched traffic; accept lets it through.
Counters: when enabled, each rule tracks how many packets and bytes matched it. Useful for debugging.

LAN only services only accept traffic from private network addresses (192.168.x.x, 10.x.x.x, 172.16.x.x). Even if your router port-forwards, these rules will block external traffic.
LAN & internet services accept traffic from any source address, including the public internet. Only use these when you intentionally want outside access.
Switching scope for a service automatically removes the other variant to avoid redundant rules.
Log rules: if a log rule has a comment, it becomes the log prefix in the output, making it easy to filter in syslog.

⚠ Before you apply: with default policy drop, make sure a rule accepts your own SSH / management traffic first — otherwise nft -f can lock you out of a remote machine. Also note that flush ruleset clears every nftables table on the host (Docker, libvirt, podman, fail2ban…), not just this one — uncheck flush ruleset first to keep the others.

Import existing ruleset

Paste the output of sudo nft list ruleset below. Only rules the importer fully understands are imported — anything it can't completely parse is skipped and reported, never imported with parts missing.