3 ms·

nftables doesn't support TPROXY.

• freedomben 9y ago
  Right, TPROXY is an iptables module (which implies that without someone to port it (assuming porting is even possible due to architectural differences), it isn't going to work on NFTables). To clarify my original question, what will cloudflare do if/when iptables finally goes away? Has thought been put into it? Will they implement their own type of TPROXY? Will they continue to support iptables themselves? There's quite a few paths, and I'm interested in which one they deem most optimal because I respect their opinions a lot.
  • iakie 9y ago
    actually, TPROXY is very very lightly coupled with iptables. In fact, you can directly use TPROXY without iptables. here's a 50 line kernel module that uses TPROXY to do the samething without touching iptables. https://pastebin.com/uxUf6MFS https://pastebin.com/uxUf6MFS looking at the nftables code, I think the only reason nftables doesn't support TPROXY is that no one wrote some of the config parsing / seralization stuff.
    • jrochkind1 9y ago
      Sounds like cloudflare might want to start trying to submit some nftables TPROXY support now, so it's there in the vanilla kernel when they end up needing it. :)
      • RandomBK 9y ago
        It'd expect someone to eventually submit such a patch, though I don't know how urgent this issue is. Iptables isn't going anywhere anytime soon, so Cloudflare can continue to use this method on the edge nodes.