Skip to main content
nftables is the packet filtering framework in current Linux kernels. Debian ships it as the default firewall backend. This guide covers a basic Debian/Ubuntu server managed over SSH.
A wrong ruleset can drop your SSH connection. Allow your actual SSH port in the ruleset and keep the VNC console available until you have tested a new login.

​
Before you start

  • Use only one firewall manager. Do not manage rules with nftables directly while UFW or firewalld is active. If you prefer a simpler tool, see UFW (Uncomplicated Firewall).
  • Software such as Docker, WireGuard, or VPN panels may add their own rules. The example below starts with flush ruleset, which removes those rules until the software adds them again.

​
Install and inspect nftables

Review any existing rules before you replace them.

​
Write a basic ruleset

Back up the current configuration file:
Edit /etc/nftables.conf:
The following example drops incoming traffic except SSH, HTTP, HTTPS, ICMP, and replies to connections the VPS opened. It covers IPv4 and IPv6 through the inet table:
Replace 22 with your actual SSH port. Add or remove service ports as needed. Keep the ICMP rule because IPv6 requires ICMPv6 to work.
The forward chain drops routed traffic. If the VPS routes traffic for a VPN or containers, add forward rules for that traffic or use the rules your VPN guide provides.

​
Check and apply the ruleset

Check the syntax without applying it:
Apply the ruleset and load it at boot:
Open a second SSH connection from your computer and confirm it works before closing your original session. Also test the application ports you allowed.

​
Restrict a service to a trusted address

For example, replace the SSH rule with one that allows SSH only from a known administrator address:
Replace the documentation address and port with your own. Use ip6 saddr for an IPv6 address. Remove the broader tcp dport 22 accept rule only after you have tested access from the trusted address.

​
Recover from a blocked connection

  1. Log in through the VNC console.
  2. Correct /etc/nftables.conf, or restore your backup with sudo cp /etc/nftables.conf.bak /etc/nftables.conf.
  3. Reload the rules with sudo nft -f /etc/nftables.conf.
If the VPS does not boot or you cannot log in through VNC, follow the Linux rescue CD guide to mount the installed system and repair its firewall configuration. For full syntax, see the nftables wiki.
Last modified on October 29, 2026