I'm using Ubuntu 18.04 on embedded system and I need to choose a firewall app between the followings: ufw, nftables, iptables.

Can you recommend one of them and why its better than the others?


  • 1
    please note: ufw uses iptables under the hood, and, in a system that has nftables, the iptables is basically using nftables through xtables-nft shim ... so ... in summary ... use ufw May 18, 2023 at 6:24
  • If you want to use Docker or any other container runtime, it's probably better to use iptables. Most interfere with nftables. I think lxc works with nftables. But definitely check nftables compatibility before implementing.
    – zoechi
    Sep 26, 2023 at 16:15

1 Answer 1


There are essentially two separate firewall stacks in the kernel: the older iptables-based stack, and the newer nftables-based stack. However, because some programs are designed to work with one and some with the other, and mixing and matching tends to cause lots of hard-to-troubleshoot breakage, on most modern systems, the iptables binary actually interacts with the nftables-based stack, so either one can be used.

ufw is designed to make firewall configuration easy. If you want to just have an easy-to-configure firewall, it's a great choice. If you need more complicated configuration, then nftables is a good choice for that because you can create a single file that has all the rules and then atomically update the rules, and it's a lot easier to work with than the iptables binary. If you're unsure, ufw is probably the right choice.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .