How to Allow a Port with iptables and nftables on Linux

To allow a port with iptables, run sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT. With nftables, write the rule into /etc/nftables.conf, for example tcp dport 443 accept, then load it with sudo nft -f /etc/nftables.conf. Rules typed on the command line are lost at reboot, so save them to a file that loads at boot.

Difficulty	Time	Works on	Needs
Intermediate	20 minutes	Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10	Root or sudo access, VNC console as a fallback

nftables is the current Linux packet filter. iptables is the older command; on current distributions the iptables command is a compatibility layer (iptables-nft) that writes nftables rules. Red Hat lists iptables-nft as deprecated in RHEL 9 (Red Hat documentation), so prefer nftables for new rulesets.

Before you start

Most people should use a front end instead: UFW on Ubuntu/Debian or firewalld on AlmaLinux/Rocky. Use raw rules only if you do not run either of them, because they overwrite each other.
You need root or a sudo user. Root users can leave out sudo.
Open the VNC console in a browser tab before you start. On a dedicated server, open a ticket if you need console access.

A ruleset with policy drop blocks everything you have not allowed, including SSH. Always allow established connections, loopback and your SSH port in the same file, and load it from a session you can recover from.

Should I use nftables or iptables?

	nftables	iptables
Command	`nft`	`iptables`, `ip6tables`
IPv4 and IPv6	One `inet` table for both	Separate rules for each
Save and load	`/etc/nftables.conf`	`iptables-save` / `iptables-restore`
Status	Current	Kept for compatibility

Convert an old iptables rule to nftables syntax with iptables-translate:

iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT

nft 'add rule ip filter INPUT tcp dport 22 counter accept'

How to set up a basic nftables firewall

Install nftables

Ubuntu / Debian
AlmaLinux / Rocky

sudo apt install nftables

sudo dnf install nftables
sudo systemctl disable --now firewalld

Only stop firewalld if you replace it with your own ruleset.

Write the ruleset

Open the file that loads at boot: /etc/nftables.conf on Ubuntu/Debian. On AlmaLinux/Rocky, create /etc/nftables/main.nft and add include "/etc/nftables/main.nft" to /etc/sysconfig/nftables.conf.

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        ct state invalid drop
        ct state { established, related } accept
        iifname "lo" accept
        meta l4proto { icmp, ipv6-icmp } accept
        tcp dport 22 accept
        tcp dport { 80, 443 } accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}

Change 22 if SSH listens on another port. Add one tcp dport or udp dport line for each service you run.

Check the syntax without applying it

sudo nft -c -f /etc/nftables.conf

No output means the file is valid.

Load the rules and enable them at boot

sudo nft -f /etc/nftables.conf
sudo systemctl enable nftables

Test SSH from a second session

flush ruleset deletes every existing rule first, including rules added by Docker, Fail2Ban or another tool. Restart those services after you load the file.

How to allow a port with nftables on the command line

Add a rule to the running ruleset (lost at reboot unless you also add it to the file):

sudo nft add rule inet filter input tcp dport 8080 accept
sudo nft add rule inet filter input udp dport 51820 accept
sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 3306 accept

Show the current rules with handles, then delete one by its handle:

sudo nft -a list ruleset
sudo nft delete rule inet filter input handle 12

How to allow a port with iptables

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT

-A appends the rule to the end of the chain. If an earlier rule drops the traffic, insert it at the top instead with -I INPUT 1. A complete basic ruleset in iptables-restore format looks like this:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
COMMIT

Test a file in this format without applying it: sudo iptables-restore --test rules.v4.

How to save iptables rules so they survive a reboot

Ubuntu / Debian
AlmaLinux / Rocky

sudo apt install iptables-persistent
sudo netfilter-persistent save

Rules are saved to /etc/iptables/rules.v4 and /etc/iptables/rules.v6 and loaded at boot.

Use nftables (above) or firewalld. Red Hat deprecates iptables-nft in RHEL 9, and new rulesets should use nft.

How to check it worked

sudo nft list ruleset
sudo iptables -L INPUT -n -v --line-numbers

Then test the port from another computer; see check if a port is open from outside.

Frequently asked questions

Why did my rules disappear after a reboot?

Rules added with nft add or iptables -A live only in memory. Put them in /etc/nftables.conf (and enable the nftables service) or save them with netfilter-persistent save.

Can I use nftables and UFW together?

Not with flush ruleset in your file, which removes UFW’s rules. Pick one tool to manage the firewall.

How do I undo a rule that locked me out?

Log in through the VNC console and run sudo nft flush ruleset, which removes all rules until the next reload. See fix being locked out after a firewall change.

Do I still need ip6tables?

With iptables, yes: IPv6 traffic ignores iptables rules. With nftables, an inet table covers both.

VPS and dedicated server guides

Every guide in this section.

Set up UFW

The simple option for Ubuntu.

Set up firewalld

The default on AlmaLinux and Rocky.

Port forwarding and NAT

Forward ports to another host.

Locked out after a firewall change

Recover access.

Checked against the official nftables wiki and Red Hat nftables documentation on 4 November 2026; the nftables ruleset (nft -c), the iptables ruleset (iptables-restore --test) and iptables-translate were tested on Ubuntu 24.04 LTS (nftables 1.0.9, iptables 1.8.10). Commands can differ on other distributions or releases.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Live Chat: Quick assistance via our website.
Support Ticket: Open a Ticket
Discord: Join our Community
Email: support@freakhosting.com

Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!

Last Updated: November 2026

Start here

Connect to your server

Linux basics

Linux security

Networking

Web servers & websites

Databases

Docker & self-hosting

Backups & storage

Performance & monitoring

Linux troubleshooting

Windows Server basics

Windows Server security & networking

Windows Server troubleshooting

Account & notifications

How to Allow a Port with iptables and nftables on Linux

Before you start

Should I use nftables or iptables?

How to set up a basic nftables firewall

How to allow a port with nftables on the command line

How to allow a port with iptables

How to save iptables rules so they survive a reboot

How to check it worked

Frequently asked questions

Why did my rules disappear after a reboot?

Can I use nftables and UFW together?

How do I undo a rule that locked me out?

Do I still need ip6tables?

VPS and dedicated server guides

Set up UFW

Set up firewalld

Port forwarding and NAT

Locked out after a firewall change

Need Extra Help?

Save on Your Hosting

​Before you start

​Should I use nftables or iptables?

​How to set up a basic nftables firewall

​How to allow a port with nftables on the command line

​How to allow a port with iptables

​How to save iptables rules so they survive a reboot

​How to check it worked

​Frequently asked questions

​Why did my rules disappear after a reboot?

​Can I use nftables and UFW together?

​How do I undo a rule that locked me out?

​Do I still need ip6tables?

​Related guides

VPS and dedicated server guides

Set up UFW

Set up firewalld

Port forwarding and NAT

Locked out after a firewall change

​Need Extra Help?

​Save on Your Hosting

Before you start

Should I use nftables or iptables?

How to set up a basic nftables firewall

How to allow a port with nftables on the command line

How to allow a port with iptables

How to save iptables rules so they survive a reboot

How to check it worked

Frequently asked questions

Why did my rules disappear after a reboot?

Can I use nftables and UFW together?

How do I undo a rule that locked me out?

Do I still need ip6tables?

Related guides

Need Extra Help?

Save on Your Hosting