Modern Firewall Management with nftables on RHEL-Based Systems (AlmaLinux, CentOS, Rocky Linux)

nftables is the packet-filtering framework in the Linux kernel that replaced iptables. On AlmaLinux, Rocky Linux and other RHEL-based systems it sits underneath firewalld, the default firewall tool, and you can also drive it directly with the nft command. This guide is for your own VPS or server with root access: it explains how the pieces fit, gives you a safe starting ruleset, and shows how to make it survive a reboot without locking yourself out.

1. How nftables, iptables and firewalld fit together

The important rule: use one manager at a time. firewalld, a hand-written nftables service, CSF and some control panels each expect to own the ruleset. Running two of them means one silently overwrites the other after a reload or reboot. Docker also adds its own rules, so test container networking after any firewall change.

2. What nftables gives you

• One syntax for IPv4 and IPv6. A table of family inet covers both, so you don't maintain two rule lists.
• Sets and maps. Put many IP addresses or ports in one named set and match them with a single rule, instead of hundreds of lines.
• Atomic loading. nft -f applies a whole file in one step, so there is never a half-applied ruleset.
• Connection tracking. Allow replies to connections the server started with one ct state established,related rule.

3. The easy route: keep firewalld

If firewalld is running (systemctl status firewalld), manage it with firewall-cmd. It writes nftables rules for you.

firewall-cmd --state
firewall-cmd --list-all
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-port=8443/tcp
firewall-cmd --reload

--permanent saves the change; --reload applies it. You can still look at the result with nft list ruleset, but don't edit firewalld's tables by hand, because the next reload replaces them.

4. Writing your own ruleset

If you prefer plain nftables, stop firewalld first so the two don't fight:

systemctl disable --now firewalld
dnf install -y nftables

On RHEL-based systems the nftables service loads /etc/sysconfig/nftables.conf at boot. That file normally includes files from /etc/nftables/. Put a ruleset like this in /etc/nftables/main.nft:

flush ruleset

table inet filter {
    set blocklist {
        type ipv4_addr
        flags interval
    }

    chain input {
        type filter hook input priority 0; policy drop;

        iif "lo" accept
        ct state established,related accept
        ct state invalid drop
        ip saddr @blocklist drop

        ip protocol icmp accept
        meta l4proto ipv6-icmp accept

        tcp dport 22 accept
        tcp dport { 80, 443 } accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Then add this line to /etc/sysconfig/nftables.conf:

include "/etc/nftables/main.nft"

What the ruleset does: it drops everything incoming by default, allows loopback and replies, allows ping and the ICMPv6 messages IPv6 needs to work, and opens SSH, HTTP and HTTPS. flush ruleset at the top makes reloading the file replace the old rules instead of adding duplicates. It also removes rules Docker created, so restart Docker afterwards if you use it. Add the ports your own services need before you apply it.

5. Apply it without locking yourself out

A wrong rule on a remote server cuts your SSH session. Schedule an automatic rollback first, then apply.

If you do lose access, use your VPS provider's console, which is not affected by the firewall, and run nft flush ruleset.

6. Everyday commands

nft list ruleset                              # everything that is loaded
nft -a list chain inet filter input           # the chain, with rule handles
nft add rule inet filter input tcp dport 3000 accept
nft delete rule inet filter input handle 12   # remove by handle
nft add element inet filter blocklist { 203.0.113.9 }
nft delete element inet filter blocklist { 203.0.113.9 }

Changes made with nft add or nft delete are live at once but are lost on reboot. Put anything you want to keep in the ruleset file and reload it with nft -f. Use the -a flag to see handles: you delete a rule by its handle, not its position.

7. Good habits

Debian and Ubuntu use the same nft syntax; there the service reads /etc/nftables.conf instead. CentOS Linux has reached end of life, so for a new server choose AlmaLinux or Rocky Linux.

8. Running this on Domain India

A Domain India VPS is self-managed with full root access, so the firewall is yours to design and run. You can choose AlmaLinux, Rocky Linux, Ubuntu or Debian when you order, and cPanel is not offered on a VPS. The card shows the live list price, excluding 18% GST.

For a UFW-based setup, see Setting up a firewall on your VPS, and for SSH hardening, the SSH security hardening checklist.

Ready to run your own firewall? Compare VPS plans, or if you're on shared hosting and blocked, open a ticket with your public IP.