Configuring nftables

As we discussed at the beginning of this chapter, iptables is being deprecated and eventually retired in Linux, in favor of nftables. With that in mind, what advantages does using nftables bring?

Deploying nftables rules is much quicker than in iptables – under the hood, iptables modifies the kernel as each rule is added. This doesn't happen in nftables. Related to that, nftables also has an API. This makes it much easier to configure using orchestration or "network as code" tools. These tools include apps such as Terraform, Ansible, Puppet, Chef, and Salt. What this allows system administrators to do is more easily automate the deployment of hosts, so that a new virtual machine can be deployed into a private or public cloud in minutes, rather than in hours. More importantly, applications that might involve several hosts can be deployed in parallel.

nftables also operates much more efficiently in the Linux kernel, so for any given ruleset...