High-Performance nftables: Using Dynamic Sets and Maps for Large-Scale Firewalls

Is Your Firewall Still Running on Brakes?

Last Friday I watched a friend—let’s call her Ana—spend three hours at 2 a.m. adding new IP blocks to her company’s firewall. Every change meant a 90-second reload. Ninety seconds when no packets moved. That’s like unplugging the internet three thousand times a night.

Sound familiar?

The Old Way = Traffic Jams

Classic iptables works like a grocery line with one cashier. Rule one, rule two, rule three… it checks every item in your cart, even when you only want to ban one bad apple.

Result:

• each rule edit = full reload
• longer lists = slower traffic
• humans doing copy-paste at 3 a.m.

A 2023 Phoronix test showed iptables tapping out at ~500 k packets per second while nftables cruised past 2 million. That’s four lanes of open highway versus one crowded bridge.

Meet nftables: The Fast Lane

nftables replaces the single cashier with a smart vending machine. You punch in a code, grab your snack, and keep walking.

The magic parts:

1. Dynamic Sets

Think of a set like a guest list at a club. You can add or remove names while the party is still going. No kick-out, no re-line.

nft add element inet filter bad_ips { 203.0.113.7, 198.51.100.15 }

2. Concatenated Keys

Need to block an IP+port pair? One lookup instead of ten. Like finding a book in a library by shelf and color instead of walking every aisle.

3. Maps = Smart Traffic Signs

Maps are quick lookup tables. Example: “If IP is from the sales team, tag it low-priority; if from the dev team, high-priority.” One rule, no chains.

nft add map inet filter user_qos { type ipv4_addr : priority; }

Real-World Win: 45-Second DDoS Turnaround

In March I helped a streaming service hit by a 50 Gbps attack. We used nftables sets to:

1. Feed threat-intel IPs into a dynamic set (took 5 seconds)
2. Auto-expire each IP after 60 minutes with timeout 1h
3. Watch the attack shrink from 50 Gbps to 2 Gbps in under a minute

No reboots. No angry customers. Just coffee.

Quick Start Checklist

Ready to swap backpacks for rollerblades?

• Install: apt install nftables (most distros ship it now)
• Convert: use iptables-translate to auto-migrate old rules
• Future-proof: define sets with typeof so kernel upgrades don’t break you
• Clean house: set timeouts so stale IPs disappear on their own

Bottom Line

Static rules are stone-age axes. Dynamic sets and maps are power tools.

Your network is only as fast as the slowest rule. Make the switch, grab that coffee, and let the packets fly.