The netfilter.org "nftables" project

What is nftables?

nftables is the project that aims to replace the existing {ip,ip6,arp,eb}tables framework. Basically, this project provides a new packet filtering framework, a new userspace utility and also a compatibility layer for {ip,ip6}tables. nftables is built upon the building blocks of the Netfilter infrastructure such as the existing hooks, the connection tracking system, the userspace queueing component and the logging subsystem.

What is the status of nftables?

It is currently under development.

Running nftables

You require the following software in order to run the new nftables utility:

nftables's Linux kernel tree
libnl-nft: the user-space library for low-level interaction with nftables Netlink's API over libnl.
nftables user-space utility

We have no releases at this moment, you can obtain the source code from the git trees.

Running {ip,ip6}tables compatibility

The nftables project provides a backward compatibility layer that allows you run iptables/ip6tables (using the same syntax) over the nftables infrastructure:

nftables's Linux kernel tree
libnftables: the user-space library for low-level interaction with nftables Netlink's API over libmnl.
iptables-nftables: the user-space utility that provides the xtables command to add rule using iptables/ip6tables syntax.

We have no releases at this moment, you can obtain the source code from the git trees.

Main Features

Pseudo-state machine in kernel-space: the userspace utility nftables interprets the rule-set provided by the user (using a new syntax), it compiles it into the pseudo-state machine bytecode and then it transfers it to the kernel via the nftables Netlink's API. Roughly, the idea behind nftables is similar to the Berkeley Packet Filters (BPF).
Fast lookups through performance data structures: The new syntax allows you to arrange you rule-set in a very performance way contrary to purely linear-list based filtering policies. Nftables allows you to use set-based action mappings, ie. for a matching element in the set, issue the action specified by the user.
Reduce the amount of code in kernel-space. You can express the packet selectors for all existing protocols using the instruction-set provided by the nftables pseudo-state machine. That means that we do not need a specific extension in kernel-space for each protocol that you want to support. As a side effect, you are likely not need to upgrade your kernel to obtain new features as it has been designed to keep most of the logic in user-space.
Unified interface to replace iptables/ip6tables/arptables/ebtables utilities. Thus, we will be able to fully get rid of all the existing code replication in kernel and user-space.

Git trees

nftables Linux kernel tree can be accessed at http://1984.lsi.us.es/git/nftables/
nftables user-space utility at: http://git.netfilter.org/nftables/
libnl-nft user-space library at: http://git.netfilter.org/libnl-nft/
backward compatibility iptables/ip6tables user-space utility at: http://git.netfilter.org/iptables-nftables/
libnftables userspace library at: http://git.netfilter.org/libnftables/

Authors

nftables kernel infrastructure has been written by Patrick McHardy and Pablo Neira Ayuso
nftables userspace utility has been written by Patrick McHardy.
iptables/ip6tables compatibility userspace utilities have been written Pablo Neira Ayuso.