4 ms·

Not to detract from the article, but we should be using nftables in 2022. :-) https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_ipset_to_nftables h

Not to detract from the article, but we should be using nftables in 2022. :-) https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_ipset_to_nftables https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro...

TacticalCoder 4y ago
He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.
- usr1106 4y ago
  Where is that wrapper? In user space or in the kernel?
  - suprjami 4y ago
    aiui the iptables-nft wrapper is userspace, it translates iptables syntax into nftables and applies those nftables rules.
- thrwawy74 4y ago
  I always feel like a git telling people "it's nftables now!", but it's been over a decade and folks keep using iptables as the common identifier. It's slow to change language. You're right, many of those iptables commands are utilities/scripts around nftables now.
  - BrandoElFollito 4y ago
    Thi is snot very much different from "use IPv6". I work in IT and it is now probably 25 years that I keep hearing that IPv6 is round the corner. "Adoption" is ~35% but what this means that in 35% of the cases, you can get to a place though IPv6. This does not mean that you must, or do. It is just the capacity. When a technology takes 25 or so years to be mainstream it means that there is a problem somewhere ("too complicated", ...) or that there is no problem in the forst place ("iptables work fine for me", "I NAT my 10.x network", ...)
- rroot 4y ago
  If you've set up your rules from scratch using nftables then they are not compatible.
gerdesj 4y ago
I started with ipfw, then ipchains, then iptables and now nftables. That is just on Linux. To be fair: I just downloaded a ipfw setup and didn't give it much thought. I spend several weeks hand crafting several ipchains scripts. I spent ages with iptables and wrote a rubbish multi WAN effort and eventually ditched it for pfSense for edge. More ages for a host based effort. I also use ufw quite a bit for iptables. I use firewalld for nftables, these days.

TacticalCoder 4y ago

He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.

usr1106 4y ago
Where is that wrapper? In user space or in the kernel?
- suprjami 4y ago
  aiui the iptables-nft wrapper is userspace, it translates iptables syntax into nftables and applies those nftables rules.
thrwawy74 4y ago
I always feel like a git telling people "it's nftables now!", but it's been over a decade and folks keep using iptables as the common identifier. It's slow to change language. You're right, many of those iptables commands are utilities/scripts around nftables now.
- BrandoElFollito 4y ago
  Thi is snot very much different from "use IPv6". I work in IT and it is now probably 25 years that I keep hearing that IPv6 is round the corner. "Adoption" is ~35% but what this means that in 35% of the cases, you can get to a place though IPv6. This does not mean that you must, or do. It is just the capacity. When a technology takes 25 or so years to be mainstream it means that there is a problem somewhere ("too complicated", ...) or that there is no problem in the forst place ("iptables work fine for me", "I NAT my 10.x network", ...)
rroot 4y ago
If you've set up your rules from scratch using nftables then they are not compatible.

gerdesj 4y ago

I started with ipfw, then ipchains, then iptables and now nftables. That is just on Linux. To be fair: I just downloaded a ipfw setup and didn't give it much thought. I spend several weeks hand crafting several ipchains scripts. I spent ages with iptables and wrote a rubbish multi WAN effort and eventually ditched it for pfSense for edge. More ages for a host based effort. I also use ufw quite a bit for iptables. I use firewalld for nftables, these days.