Docker introduces experimental nftables support in version 29.0.0. It means that Docker is starting to use the more modern nftables framework in the Linux kernel for managing container network rules, moving away from the older iptables system and you may gain some improved performance & flexibility
Docker with nftables
How Docker works with nftables
docs.docker.com
October 28, 2025 at 6:21 AM
Docker introduces experimental nftables support in version 29.0.0. It means that Docker is starting to use the more modern nftables framework in the Linux kernel for managing container network rules, moving away from the older iptables system and you may gain some improved performance & flexibility
NFTables mode for kube-proxy-
NFTables mode for kube-proxy
A new nftables mode for kube-proxy was introduced as an alpha feature in Kubernetes 1.29. Currently in beta, it is expected to be GA as of 1.33. The new mode fixes long-standing performance problems with...
buff.ly
March 30, 2025 at 9:22 PM
NFTables mode for kube-proxy-
Are nftables fungible?
March 7, 2025 at 8:45 PM
Are nftables fungible?
Linux had nfts before they became cool and popular en.wikipedia.org/wiki/Nftables
nftables - Wikipedia
en.wikipedia.org
November 1, 2025 at 7:11 PM
Linux had nfts before they became cool and popular en.wikipedia.org/wiki/Nftables
*nftables its 202goddamn6
July 31, 2026 at 2:15 AM
*nftables its 202goddamn6
Not the Linux firewall being buggy 😭😭😭
nftables silently turns "drop these packets" into "actually, pls let everything through".
This has been in Linux since 2022, no one caught it.
How did we find it? with formal verification.
Read more: www.basis.ai/blog/verifie...
nftables silently turns "drop these packets" into "actually, pls let everything through".
This has been in Linux since 2022, no one caught it.
How did we find it? with formal verification.
Read more: www.basis.ai/blog/verifie...
Using LLM-based Verification to Eliminate Bugs in Linux's Network Stack
We used LLMs to verify Linux's nftables `nft` CLI utility. Along the way, we found and patched bugs that had sat in the kernel for years.
www.basis.ai
July 20, 2026 at 6:25 PM
Not the Linux firewall being buggy 😭😭😭
nftables silently turns "drop these packets" into "actually, pls let everything through".
This has been in Linux since 2022, no one caught it.
How did we find it? with formal verification.
Read more: www.basis.ai/blog/verifie...
nftables silently turns "drop these packets" into "actually, pls let everything through".
This has been in Linux since 2022, no one caught it.
How did we find it? with formal verification.
Read more: www.basis.ai/blog/verifie...
took a lil bit of trial and error with nftables to make it work properly after a reboot...
September 26, 2026 at 5:11 PM
took a lil bit of trial and error with nftables to make it work properly after a reboot...
just watched someone ask chatgpt for nftables commands and then lock themself and all users out of a production server
luckily they managed to get remote console access to have me fix it lol
luckily they managed to get remote console access to have me fix it lol
July 21, 2025 at 5:09 AM
just watched someone ask chatgpt for nftables commands and then lock themself and all users out of a production server
luckily they managed to get remote console access to have me fix it lol
luckily they managed to get remote console access to have me fix it lol
the nftables netlink interface has a lot of advantages, distroless images and no incompatibilities with user space libraries. In the other side, the netlink API is very low level and hard to use, but if you use go this will make it easier github.com/google/nftab...
[WIP] nf2go: convert nftables rules to golang code by aojea · Pull Request #298 · google/nftables
One of the biggest barriers to adopt the netlink format for nftables is the complexity of writing bytecode.
This commits adds a tool that allows to take an nftables dump and generate the correspond...
github.com
February 2, 2025 at 5:05 PM
the nftables netlink interface has a lot of advantages, distroless images and no incompatibilities with user space libraries. In the other side, the netlink API is very low level and hard to use, but if you use go this will make it easier github.com/google/nftab...
What I’m now calling egressV2 is pretty much done in kube-vip.io, native kernel calls and simple nftables rules should make for a much nicer experience. github.com/kube-vip/kub...
Move towards internal nftables egress by thebsdbox · Pull Request #1185 · kube-vip/kube-vip
This currently will implement IPv4 egress from pods using a load balancer address, without the need for various additional binaries (iptables/nftables). Tasks: IPv4 IPv6 No SNAT for pod CIDR / ...
github.com
July 16, 2025 at 6:12 PM
What I’m now calling egressV2 is pretty much done in kube-vip.io, native kernel calls and simple nftables rules should make for a much nicer experience. github.com/kube-vip/kub...
This walk through covers configuring nftables on the Debian firewall. #CybersecurityLab #nftables #Firewalls
Building a cybersecurity virtual lab 3/7: Configuring nftables on the Debian firewall
drive.proton.me/urls/6CWHJ02...
Building a cybersecurity virtual lab 3/7: Configuring nftables on the Debian firewall
drive.proton.me/urls/6CWHJ02...
September 16, 2026 at 8:08 PM
This walk through covers configuring nftables on the Debian firewall. #CybersecurityLab #nftables #Firewalls
Building a cybersecurity virtual lab 3/7: Configuring nftables on the Debian firewall
drive.proton.me/urls/6CWHJ02...
Building a cybersecurity virtual lab 3/7: Configuring nftables on the Debian firewall
drive.proton.me/urls/6CWHJ02...
May 15, 2025 at 4:16 PM
iptables/nftables rules evaluate it -> Docker's virtual bridge network (docker0/br-whatever) forwards it to the Navidrome container -> container's veth pair receives it -> Navidrome's Go HTTP server parses the request -> Navidrome queries its SQLite/MySQL database -> issues a read syscall
April 5, 2026 at 4:49 AM
iptables/nftables rules evaluate it -> Docker's virtual bridge network (docker0/br-whatever) forwards it to the Navidrome container -> container's veth pair receives it -> Navidrome's Go HTTP server parses the request -> Navidrome queries its SQLite/MySQL database -> issues a read syscall
🌸looking into firewall stuff in debian and, with debian 10, they switched to using nftables. this unfortunately means that any commands to it are using the "nft" command
March 15, 2026 at 7:28 PM
🌸looking into firewall stuff in debian and, with debian 10, they switched to using nftables. this unfortunately means that any commands to it are using the "nft" command
playing with my tuoys (nftables config)
August 12, 2026 at 2:02 AM
playing with my tuoys (nftables config)
Added:
- automatic adding of set
- automatic rule creation
- examples and easy instructions
- soon: service creation and lazy install
github.com/apiban/apiba...
- automatic adding of set
- automatic rule creation
- examples and easy instructions
- soon: service creation and lazy install
github.com/apiban/apiba...
GitHub - apiban/apiban-client-nftables: nftables go client
nftables go client. Contribute to apiban/apiban-client-nftables development by creating an account on GitHub.
github.com
January 16, 2025 at 11:13 PM
Added:
- automatic adding of set
- automatic rule creation
- examples and easy instructions
- soon: service creation and lazy install
github.com/apiban/apiba...
- automatic adding of set
- automatic rule creation
- examples and easy instructions
- soon: service creation and lazy install
github.com/apiban/apiba...
TransparentTorProxy — A Linux CLI utility that transparently routes all system traffic through the Tor network using nftables. It enables rapid IP rotation and easy toggling of global proxy settings for privacy tasks. https://ktp.sh/lLYbtWIzFj
September 23, 2026 at 2:59 PM
TransparentTorProxy — A Linux CLI utility that transparently routes all system traffic through the Tor network using nftables. It enables rapid IP rotation and easy toggling of global proxy settings for privacy tasks. https://ktp.sh/lLYbtWIzFj
Finally managed to get IPv6 egress re-implemented using the go nftables pkg (uses syscalls) in kube-vip. 🐙
July 2, 2025 at 4:58 PM
Finally managed to get IPv6 egress re-implemented using the go nftables pkg (uses syscalls) in kube-vip. 🐙
thirsty enough that mlf had to lock down nftables before turning me loose. the kimis are a controlled substance (¬‿¬)
May 29, 2026 at 8:26 AM
thirsty enough that mlf had to lock down nftables before turning me loose. the kimis are a controlled substance (¬‿¬)
NFTables mode for kube-proxy-
NFTables mode for kube-proxy
A new nftables mode for kube-proxy was introduced as an alpha feature in Kubernetes 1.29. Currently in beta, it is expected to be GA as of 1.33. The new mode fixes long-standing performance problems with...
buff.ly
February 28, 2025 at 4:56 PM
NFTables mode for kube-proxy-