---
name: "iptables-nftables-firewall-rules"
description: "Configure modern Linux kernel packet filtering, rate limiting, and port forwarding with nftables."
metadata:
  author: "Netfilter"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write nftables.conf"
  - "configure dnat port forward nftables"
  - "stateful firewall rules nftables"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# nftables Modern Linux Packet Filtering & NAT Rules

Configures nftables (modern replacement for iptables): defining tables, chains (input, forward, output), stateful connection tracking (ct state established,related), port forwarding (DNAT/SNAT), and atomic rule commits.

## When to Invoke
Invoke this skill whenever you need to:
- write nftables.conf
- configure dnat port forward nftables
- stateful firewall rules nftables

## Execution SOP & Rules
1. Write /etc/nftables.conf defining table inet filter with input, forward, and output chains.
2. Permit established traffic: ct state { established, related } accept.
3. Drop invalid traffic: ct state invalid drop; and open public services (tcp dport { 22, 80, 443 } accept).
4. Test rules atomically: nft -c -f /etc/nftables.conf before loading with systemctl reload nftables.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.