Tink vs nftables
nftables is the modern Linux packet filter. It writes netfilter rules. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
nft list ruleset. Tink answers “why is this VPS sick?”
Accidental sysadmins land on nftables because the first SSH login still ends in nft add rule inet filter input tcp dport 80 accept. Then disk is at 91%, nginx dies, and last night's input chain does not say what to run. A filling /var is a Tink warning; it is not a drop verdict.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using nftables if you already want a host packet filter. Use Tink if you run Linux servers and want a mechanic. They can sit on the same box.
| Feature | Tink | nftables |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Install nftables, write inet filter/nat tables, save /etc/nftables.conf, hope nftables.service loads them after reboot — then you still SSH in when the box is sick |
| What you get | Working monitoring, diagnosis, and approved fixes | Netfilter packet filter — tables, chains, sets, maps, verdicts. Not a fleet mechanic |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who reads nft list ruleset after the outage |
| Hidden costs | None — fully managed | Set timeouts, iptables-nft compat, Docker NAT, and whether anyone watched disk while input was accept |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Packet filter only. nftables does not watch fill time or propose a restart |
| Configuration | None after install — heuristics and AI | nftables.conf, include snippets, and whether the restore unit actually ran |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read nft list ruleset and conntrack yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Opens and closes ports only — nftables cannot restart nginx, free disk, or rotate a cert |
| Alerting | Built-in across 8 channels | None. A silent drop in input is not a Telegram page |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live packet filter only — nftables does not forecast fill time or a quiet NIC going bad later |
| Firewall / port exposure | Built-in — warns when the host firewall is inactive or dangerous DB ports listen | Yes for filter/nat — that is the job. It still will not say Redis is bound to 0.0.0.0 |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down, nftables is down too — no presence ping to Telegram |
| Public status page | Shareable URL with 90-day history | Not included — nftables has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a ruleset dump is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + nft list ruleset. No mechanic you text when /var filled |
| Learning curve | None — works after install | Low to nft add rule inet filter input tcp dport 22 accept; higher to keep sets, maps, and iptables-nft honest |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators who already want a host packet filter and will still SSH in when the box is sick |
When nftables is the right choice
Keep using nftables when you already want that exact job:
- Host packet filter — you need inet filter/nat on this box, not a fleet digest.
- Netfilter CLI — nft talks to the kernel; it is not a mechanic.
- No extra service — a userspace tool on the box, not a hub, SaaS, or Telegram bot.
- No conversation layer wanted — some operators prefer nftables.conf and will never use a mechanic.
The real cost of “just write nftables rules”
The package is cheap to install. A working ops loop for five Linux boxes is not:
- A complete inet filter still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and a quiet agent never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — nftables stays a ruleset dump until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another accept rule
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens nft list ruleset after the outage, and every scan includes a diagnosis a quiet packet filter will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs fail2ban · Tink vs CrowdSec · Tink vs sshguard