端口「本机 curl 通、外网不通」、Docker 改表导致规则错乱，需要先分清 nftables 原生集合 与 iptables-nft 兼容，再谈策略。
源码锚点
| 路径 / 手册 | 作用 |
|---|---|
man nft |
nftables 命令 |
man iptables |
兼容前端 |
/etc/nftables.conf |
常见落盘 |
man nftables |
集合概念 |
放行本机 SSH 示例（示意）：
bash
nft add table inet filter
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input iif lo accept
nft add rule inet filter input tcp dport 22 accept调用链
#mermaid-svg-cgelA9lhcxHpPdBO{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#mermaid-svg-cgelA9lhcxHpPdBO .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#mermaid-svg-cgelA9lhcxHpPdBO .error-icon{fill:#552222;}#mermaid-svg-cgelA9lhcxHpPdBO .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-thickness-normal{stroke-width:1px;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-thickness-invisible{stroke-width:0;fill:none;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-cgelA9lhcxHpPdBO .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-cgelA9lhcxHpPdBO .marker{fill:#333333;stroke:#333333;}#mermaid-svg-cgelA9lhcxHpPdBO .marker.cross{stroke:#333333;}#mermaid-svg-cgelA9lhcxHpPdBO svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-cgelA9lhcxHpPdBO p{margin:0;}#mermaid-svg-cgelA9lhcxHpPdBO .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaid-svg-cgelA9lhcxHpPdBO .cluster-label text{fill:#333;}#mermaid-svg-cgelA9lhcxHpPdBO .cluster-label span{color:#333;}#mermaid-svg-cgelA9lhcxHpPdBO .cluster-label span p{background-color:transparent;}#mermaid-svg-cgelA9lhcxHpPdBO .label text,#mermaid-svg-cgelA9lhcxHpPdBO span{fill:#333;color:#333;}#mermaid-svg-cgelA9lhcxHpPdBO .node rect,#mermaid-svg-cgelA9lhcxHpPdBO .node circle,#mermaid-svg-cgelA9lhcxHpPdBO .node ellipse,#mermaid-svg-cgelA9lhcxHpPdBO .node polygon,#mermaid-svg-cgelA9lhcxHpPdBO .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-cgelA9lhcxHpPdBO .rough-node .label text,#mermaid-svg-cgelA9lhcxHpPdBO .node .label text,#mermaid-svg-cgelA9lhcxHpPdBO .image-shape .label,#mermaid-svg-cgelA9lhcxHpPdBO .icon-shape .label{text-anchor:middle;}#mermaid-svg-cgelA9lhcxHpPdBO .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#mermaid-svg-cgelA9lhcxHpPdBO .rough-node .label,#mermaid-svg-cgelA9lhcxHpPdBO .node .label,#mermaid-svg-cgelA9lhcxHpPdBO .image-shape .label,#mermaid-svg-cgelA9lhcxHpPdBO .icon-shape .label{text-align:center;}#mermaid-svg-cgelA9lhcxHpPdBO .node.clickable{cursor:pointer;}#mermaid-svg-cgelA9lhcxHpPdBO .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#mermaid-svg-cgelA9lhcxHpPdBO .arrowheadPath{fill:#333333;}#mermaid-svg-cgelA9lhcxHpPdBO .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-cgelA9lhcxHpPdBO .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-cgelA9lhcxHpPdBO .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-cgelA9lhcxHpPdBO .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#mermaid-svg-cgelA9lhcxHpPdBO .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-cgelA9lhcxHpPdBO .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#mermaid-svg-cgelA9lhcxHpPdBO .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-cgelA9lhcxHpPdBO .cluster text{fill:#333;}#mermaid-svg-cgelA9lhcxHpPdBO .cluster span{color:#333;}#mermaid-svg-cgelA9lhcxHpPdBO div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-cgelA9lhcxHpPdBO .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#mermaid-svg-cgelA9lhcxHpPdBO rect.text{fill:none;stroke-width:0;}#mermaid-svg-cgelA9lhcxHpPdBO .icon-shape,#mermaid-svg-cgelA9lhcxHpPdBO .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#mermaid-svg-cgelA9lhcxHpPdBO .icon-shape p,#mermaid-svg-cgelA9lhcxHpPdBO .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#mermaid-svg-cgelA9lhcxHpPdBO .icon-shape .label rect,#mermaid-svg-cgelA9lhcxHpPdBO .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#mermaid-svg-cgelA9lhcxHpPdBO .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#mermaid-svg-cgelA9lhcxHpPdBO .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#mermaid-svg-cgelA9lhcxHpPdBO :root{--mermaid-font-family:"trebuchet ms",verdana,arial,sans-serif;} accept
drop/reject
网卡收包
Netfilter hooks
nftables 规则集
协议栈
丢弃/重置
重点知识
查清当前用哪套
bash
nft list ruleset
iptables -L -n -v
# 有的系统 iptables 是 nft 后端
update-alternatives --display iptables 2>/dev/null策略设计
- 默认策略与显式 accept 成对出现。
established,related放前面，避免回包被丢。- 管理口（SSH）先保证，再收紧。
容器与防火墙
Docker/Podman 会插入自己的链。排障时同时看 nft list ruleset 与容器网络，不要只改 filter 的 input。
持久化
bash
nft list ruleset > /etc/nftables.conf
systemctl enable --now nftables重启后规则消失 = 没落盘或服务未开。