nft
which packets may passnft is the front end to nftables, the packet filter that replaced iptables. Rules live in chains hooked into the packet path and are read top to bottom: the first rule with a verdict ends the walk, and the chain's policy decides whatever reaches the bottom.
A firewall is an ordered list with a default — and the default is the most important line in it.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
One table filters IPv4 and IPv6 together, which closes the old gap where only the IPv4 rules were ever written.
"hook input" attaches the chain to packets addressed to this host. "policy drop" is the default: anything no rule accepts is discarded.
Replies to connections this host opened are accepted here, so the rules below only have to describe new inbound traffic.
New TCP connections to port 22 are let in. This single line is the host's entire inbound attack surface.
318 packets reached the end of the chain and were dropped. A number that climbs quickly is a scan in progress.
Switches
A switch changes how the command behaves. These are the ones used day to day; man nft lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-a- Show each rule’s handle — the number needed to delete or replace it.
-f FILE- Load a ruleset from a file.
-c- Check: parse the commands and report errors without applying anything.
-n- Numeric: show addresses and ports as numbers.
-s- Stateless: leave counters and other changing state out of the listing.
-j- Print JSON, for scripts.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
nft add rule inet filter input tcp dport 443 acceptAppends a rule opening HTTPS. Appended after a final drop rule it would never be reached — order matters.
nft -a list chain inet filter inputLists one chain with rule handles, the numbers needed to delete or insert a specific rule.
nft delete rule inet filter input handle 7Removes exactly one rule by its handle.
nft -f /etc/nftables.confLoads a whole ruleset from a file in one atomic step — the way to make changes that survive a reboot.
In cybersecurity
The ruleset is the host's own statement of what it is willing to hear. Most firewall failures are not clever bypasses — they are a rule in the wrong place or a default left open.
A policy of accept with a few drop rules fails open. Start from drop and list what is allowed.
The first matching verdict wins. A broad accept near the top silently cancels every drop beneath it.
Apply changes over SSH with a timed rollback, and keep the established,related rule first.
An output chain that allows everything lets a compromised host call out freely. Egress filtering limits the damage.
A drop with no log line is invisible. Count and rate-limit the log so a scan cannot fill the disk.
Docker, firewalld and hand-written rules all write to the same kernel tables. Read the live ruleset, not just the config file.