EL 8: nftables replaces iptables

EL 8 switches the firewall stack’s default backend from iptables to nftables: rules generated by firewalld land in the nftables kernel framework, while the iptables commands remain usable through an nft compatibility layer. This is a key step in modernizing the EL network stack, and it paved the way for more complex flow tables and performance work later.

What changed

nftables is the unified successor to iptables/ip6tables/arptables/ebtables: a single kernel framework and a single userspace tool, nft, with rules described in an expression syntax, supporting atomic batch updates (no more “half-changed ruleset” windows), and better performance and maintainability.

EL 8’s switch is “replace the backend, keep the front end compatible”:

• firewalld’s FirewallBackend=nftables setting (/etc/firewalld/firewalld.conf) becomes the default;
• iptables / ip6tables / arptables / ebtables become compatibility front ends over nft; the rules you see through them are translated views of nft rules;
• programs using the iptables kernel API directly (some old container network plugins, security agents) need adaptation.

EL 7 vs EL 8

Item	EL 7	EL 8
firewalld backend	iptables	nftables (default)
Inspecting rules	iptables -L	nft list ruleset (compat commands still work)
Batch updates	rule by rule	atomic
Number of frameworks	iptables/ip6tables/arptables/ebtables	unified nftables

What it means for you

• firewalld-based workflows: firewall-cmd syntax is unchanged — nearly invisible.
• Hand-written iptables rules and scripts: iptables-save output format and semantic details differ; translating rules into firewalld or rewriting them as nft syntax is the safer path.
• Third-party network components: old container network plugins and IDS/traffic-mirroring agents that manipulate iptables tables directly must upgrade to nftables-aware versions.
• Troubleshooting habits: inspect rules with nft list ruleset; the compatibility commands’ view may not match the actual table structure.

Caution

Do not mix: on one machine, using firewalld while also writing raw iptables rules by hand leads more easily to “rules overwritten / unexpected ordering” under the nftables backend. Pick one management layer and stick with it.

Checking and migrating

Show the current backend and ruleset

grep FirewallBackend /etc/firewalld/firewalld.conf
sudo nft list ruleset | head -30

1. Inventory hand-written iptables rules and components that depend on iptables;
2. Move rules into firewalld (zones/services/rich rules) or rewrite them as nft scripts;
3. Upgrade third-party components to versions that declare nftables support.

Further reading

• firewalld basics — zones, services, and rich rules in practice
• firewalld advanced — complex rules and troubleshooting
• EL 9: cgroup v2 by default — the next generation’s default switch
• EL 8: A new toolchain — kernel changes in the same release