4 ms·
> nft avoids having to duplicate ipv4/ipv6 rules Sometimes. # IPv4 TCP traffic ip protocol tcp reject with tcp reset # IPv6 TCP traffic (n
by mgsouth 4y ago
> nft avoids having to duplicate ipv4/ipv6 rules
Sometimes.
# IPv4 TCP traffic
ip protocol tcp reject with tcp reset
# IPv6 TCP traffic (note: "6" is TCP protocol, not IPv6)
meta l4proto 6 reject with tcp reset
nftables has some rough API, and to my mind design, edges. It strikes me as being very bottom-up driven--specific kernel rountines and data structures were targetted, and then some kind of API was figured out. The documentation kind of reflects that, too; much more "this is what changed, this is how the flow changes", than "here's how this general goal should be approached."
That said, it works, its an improvement on iptables, and the configuration isn't any worse than iptables. Kernel maintainers really do prefer bottom-up; green-field replacements are frowned on because they're hard to digest and vet.