nf_tables [LWN.net]

nf_tables

Posted May 8, 2026 14:51 UTC (Fri) by 5fdb1f (guest, #156654)
Parent article: killswitch for short-term emergency vulnerability mitigation

The commit message casually mentions nf_tables among rarely used features. I was under the impression that they're the future and are used by most distributions even if you use the iptables command. So which is it?

to post comments

nf_tables

Posted May 8, 2026 15:02 UTC (Fri) by sashal (✭ supporter ✭, #81842) [Link] (2 responses)

This is very usecase dependent. On my laptop (running debian), for example, nothing uses nf_tables right now.

Would some packages and usecases break if I we killswitch nf_tables? sure.

Would it affect my current day-to-day work? nope.

nf_tables

Posted May 9, 2026 11:54 UTC (Sat) by kleptog (subscriber, #1183) [Link] (1 responses)

Are you sure? I thought I didn't use nf_tables, but then I was wondering why iptables no longer had packet counts. Asking Copilot said I should check iptables:

$ iptables --version
iptables v1.8.10 (nf_tables)

It's a side-effect of the compatibility layer. So I was actually using nf_tables all along. Anyone using for example docker or libvirt since Debian 10+ is probably using it.

nf_tables

Posted May 9, 2026 13:03 UTC (Sat) by sashal (✭ supporter ✭, #81842) [Link]

So it's definitely installed and enabled on my laptop, however:

$ sudo nft list tables | wc -l
0
$ sudo nft list ruleset | wc -l
0