> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Allow a Port with iptables and nftables on Linux

> Allow a port with iptables (sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT) or nftables, build a default-drop ruleset and keep rules after a reboot.

To allow a port with iptables, run `sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT`. With nftables, write the rule into `/etc/nftables.conf`, for example `tcp dport 443 accept`, then load it with `sudo nft -f /etc/nftables.conf`. Rules typed on the command line are lost at reboot, so save them to a file that loads at boot.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 20 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access, VNC console as a fallback |

nftables is the current Linux packet filter. iptables is the older command; on current distributions the `iptables` command is a compatibility layer (`iptables-nft`) that writes nftables rules. Red Hat lists `iptables-nft` as deprecated in RHEL 9 ([Red Hat documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters)), so prefer nftables for new rulesets.

## Before you start

* Most people should use a front end instead: [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) on Ubuntu/Debian or [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md) on AlmaLinux/Rocky. Use raw rules only if you do not run either of them, because they overwrite each other.
* You need root or a sudo user. Root users can leave out `sudo`.
* Open the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) in a browser tab before you start. On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need console access.

> [!WARNING]
>
> A ruleset with `policy drop` blocks everything you have not allowed, including SSH. Always allow established connections, loopback and your SSH port in the same file, and load it from a session you can recover from.

## Should I use nftables or iptables?

| | nftables | iptables |
| - | - | - |
| Command | `nft` | `iptables`, `ip6tables` |
| IPv4 and IPv6 | One `inet` table for both | Separate rules for each |
| Save and load | `/etc/nftables.conf` | `iptables-save` / `iptables-restore` |
| Status | Current | Kept for compatibility |

Convert an old iptables rule to nftables syntax with `iptables-translate`:

```bash theme={null}
iptables-translate -A INPUT -p tcp --dport 22 -j ACCEPT
```

```text theme={null}
nft 'add rule ip filter INPUT tcp dport 22 counter accept'
```

## How to set up a basic nftables firewall

**1. Install nftables**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt install nftables
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo dnf install nftables
> sudo systemctl disable --now firewalld
> ```
>
> Only stop firewalld if you replace it with your own ruleset.

**2. Write the ruleset**

Open the file that loads at boot: `/etc/nftables.conf` on Ubuntu/Debian. On AlmaLinux/Rocky, create `/etc/nftables/main.nft` and add `include "/etc/nftables/main.nft"` to `/etc/sysconfig/nftables.conf`.

```text theme={null}
#!/usr/sbin/nft -f
flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        ct state invalid drop
        ct state { established, related } accept
        iifname "lo" accept
        meta l4proto { icmp, ipv6-icmp } accept
        tcp dport 22 accept
        tcp dport { 80, 443 } accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}
```

Change `22` if SSH listens on another port. Add one `tcp dport` or `udp dport` line for each service you run.

**3. Check the syntax without applying it**

```bash theme={null}
sudo nft -c -f /etc/nftables.conf
```

No output means the file is valid.

**4. Load the rules and enable them at boot**

```bash theme={null}
sudo nft -f /etc/nftables.conf
sudo systemctl enable nftables
```

**5. Test SSH from a second session**

Log in from a new terminal before you close the current one.

`flush ruleset` deletes every existing rule first, including rules added by Docker, Fail2Ban or another tool. Restart those services after you load the file.

## How to allow a port with nftables on the command line

Add a rule to the running ruleset (lost at reboot unless you also add it to the file):

```bash theme={null}
sudo nft add rule inet filter input tcp dport 8080 accept
sudo nft add rule inet filter input udp dport 51820 accept
sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 3306 accept
```

Show the current rules with handles, then delete one by its handle:

```bash theme={null}
sudo nft -a list ruleset
sudo nft delete rule inet filter input handle 12
```

## How to allow a port with iptables

```bash theme={null}
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
```

`-A` appends the rule to the end of the chain. If an earlier rule drops the traffic, insert it at the top instead with `-I INPUT 1`. A complete basic ruleset in `iptables-restore` format looks like this:

```text theme={null}
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
COMMIT
```

Test a file in this format without applying it: `sudo iptables-restore --test rules.v4`.

## How to save iptables rules so they survive a reboot

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt install iptables-persistent
> sudo netfilter-persistent save
> ```
>
> Rules are saved to `/etc/iptables/rules.v4` and `/etc/iptables/rules.v6` and loaded at boot.

> [tab] AlmaLinux / Rocky
>
> Use nftables (above) or firewalld. Red Hat deprecates `iptables-nft` in RHEL 9, and new rulesets should use `nft`.

## How to check it worked

```bash theme={null}
sudo nft list ruleset
sudo iptables -L INPUT -n -v --line-numbers
```

Then test the port from another computer; see [check if a port is open from outside](https://help.freakhosting.com/portals/other/how-to-check-if-a-port-is-open-from-outside.md).

## Frequently asked questions

### Why did my rules disappear after a reboot?

Rules added with `nft add` or `iptables -A` live only in memory. Put them in `/etc/nftables.conf` (and enable the `nftables` service) or save them with `netfilter-persistent save`.

### Can I use nftables and UFW together?

Not with `flush ruleset` in your file, which removes UFW's rules. Pick one tool to manage the firewall.

### How do I undo a rule that locked me out?

Log in through the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) and run `sudo nft flush ruleset`, which removes all rules until the next reload. See [fix being locked out after a firewall change](https://help.freakhosting.com/portals/other/how-to-fix-locked-out-after-firewall-change.md).

### Do I still need ip6tables?

With iptables, yes: IPv6 traffic ignores `iptables` rules. With nftables, an `inet` table covers both.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> The simple option for Ubuntu.

> [card] [Set up firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md)
>
> The default on AlmaLinux and Rocky.

> [card] [Port forwarding and NAT](https://help.freakhosting.com/portals/other/how-to-set-up-port-forwarding-and-nat-with-iptables.md)
>
> Forward ports to another host.

> [card] [Locked out after a firewall change](https://help.freakhosting.com/portals/other/how-to-fix-locked-out-after-firewall-change.md)
>
> Recover access.

***

> [!NOTE]
>
> **Checked against the official [nftables wiki](https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_server) and [Red Hat nftables documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/getting-started-with-nftables_firewall-packet-filters)** on 4 November 2026; the nftables ruleset (`nft -c`), the iptables ruleset (`iptables-restore --test`) and `iptables-translate` were tested on Ubuntu 24.04 LTS (nftables 1.0.9, iptables 1.8.10). Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.