4 ms·

These are all very kernel-orientated improvements. My guess is that a 'common' user (whatever that may be), cares very little about the efficiency or improved s

These are all very kernel-orientated improvements. My guess is that a 'common' user (whatever that may be), cares very little about the efficiency or improved storage benefits of a new firewall command. As for users with poorly configured iptables, fair enough but the latest and greatest new firewall toolset will give ample opportunity to create new poorly configured nftables too. This is all coming from a bitter old sysadmin who has had to re-tool through ipfwadm, ipchains and iptables, and who knows what else in the coming future. I'm sure each iteration has brought improvements to newer setups and advanced networking, but this smells like just another "let's re-write some tools" project.

lclarkmichalek 10y ago
ipfwadm - pre 1996 (I think?) ipchains - pre 1998 according to wikipedia iptables - 1998 according to wikipedia nftables - 2014 More churn than javascript frameworks. Realistically iptables isn't going anywhere, though I'm def looking forward to nftables being more widely used. My main interest is around the newer setups and advanced networking, but if you're not dealing with one of them, then you 1) probably won't have to port anything to nftables this decade, and 2) could probably get away with using a higher level tool like UFW
- krakensden 10y ago
  Plus, current iptables runs on top of nftables, doesn't it?
  - lclarkmichalek 10y ago
    iptables the kernel component might run on top of netfilter (i.e. there are various `nf_` modules loaded in my kernel, some of which are being used by `iptables_` modules), though I doubt iptables the user space component relies on ntf/nftables the user space component. Could be wrong I guess (comment and I shall edit this out if I'm wrong) As an aside, that's one of the nice things about nftables. No more conflating the user space binary, the user space format, the kernel module and so on.
  - click170 10y ago
    My understanding is that iptables and nftables are both user interfaces to configure rule-sets in the NetFilter code, though I think that glosses over some important bits.
- sneak 10y ago
  > More churn than javascript frameworks. 4 in 20 years. No.
  - josegonzalez 10y ago
    I believe the poster you are replying to meant that with a touch of sarcasm.
    - aisofteng 10y ago
      Blatant sarcasm.
kbenson 10y ago
I can't really speak to nftables, as I've only used it in passing once or twice (I don't do nearly as much sysadmin work anymore), but once you've experienced OpenBSD's PF it becomes immediately obvious how poor of an abstraction iptables is. Anything which brings the Linux firewall capabilities and configuration closer to what is achieved through PF is a good thing in my book, and from what I've gleaned nftables goes some way towards this.

lclarkmichalek 10y ago

ipfwadm - pre 1996 (I think?) ipchains - pre 1998 according to wikipedia iptables - 1998 according to wikipedia nftables - 2014 More churn than javascript frameworks. Realistically iptables isn't going anywhere, though I'm def looking forward to nftables being more widely used. My main interest is around the newer setups and advanced networking, but if you're not dealing with one of them, then you 1) probably won't have to port anything to nftables this decade, and 2) could probably get away with using a higher level tool like UFW

krakensden 10y ago
Plus, current iptables runs on top of nftables, doesn't it?
- lclarkmichalek 10y ago
  iptables the kernel component might run on top of netfilter (i.e. there are various `nf_` modules loaded in my kernel, some of which are being used by `iptables_` modules), though I doubt iptables the user space component relies on ntf/nftables the user space component. Could be wrong I guess (comment and I shall edit this out if I'm wrong) As an aside, that's one of the nice things about nftables. No more conflating the user space binary, the user space format, the kernel module and so on.
- click170 10y ago
  My understanding is that iptables and nftables are both user interfaces to configure rule-sets in the NetFilter code, though I think that glosses over some important bits.
sneak 10y ago
> More churn than javascript frameworks. 4 in 20 years. No.
- josegonzalez 10y ago
  I believe the poster you are replying to meant that with a touch of sarcasm.
  - aisofteng 10y ago
    Blatant sarcasm.

kbenson 10y ago

I can't really speak to nftables, as I've only used it in passing once or twice (I don't do nearly as much sysadmin work anymore), but once you've experienced OpenBSD's PF it becomes immediately obvious how poor of an abstraction iptables is. Anything which brings the Linux firewall capabilities and configuration closer to what is achieved through PF is a good thing in my book, and from what I've gleaned nftables goes some way towards this.