The Linux kernel’s packet-filtering framework that succeeded iptables is nftables.
nftables was designed as a replacement for the older iptables family and became part of the mainline Linux kernel in version 3.13, released in January 2014. It uses the Netfilter infrastructure, including packet hooks, connection tracking, logging, and userspace queues.
A common mix-up is Netfilter: Netfilter is the broader kernel networking framework, while nftables is the newer packet-filtering system built on it. The command-line tool used to configure nftables is also called `nft`. Compatibility tools can translate many older iptables rules into nftables syntax, and some distributions provide iptables commands backed by nftables.
Compared with iptables, nftables reduces duplicated code across IPv4, IPv6, ARP, and Ethernet filtering. It also supports sets, maps, concatenations, improved error reporting, and atomic rule updates. eBPF can implement packet-processing programs, but it is not the canonical successor to iptables in this context.