4 ms·
But don’t have to cobble together a bunch of arcane iptables commands and then combine bpf and other userland tools … when one can just use the clean syntax of
by gigatexal 3y ago
But don’t have to cobble together a bunch of arcane iptables commands and then combine bpf and other userland tools … when one can just use the clean syntax of PF especially for home use that’s a clear win.
- ADSSDA 3y agoI've used both extensively and I find eBPF+iptables (and sometimes nft) significantly more flexible and easier to use in the real world (not just simple examples) than PF. shrug
- gigatexal 3y agoDo you have a sample or blogpost of how your setup looks? I’m keen to see how folks are using eBPF in the personal firewall space
- throw0101a 3y ago> But don’t have to cobble together a bunch of arcane iptables commands If you did manage to figure out the iptables commands you now have to change them over to nftables. :)
- lillecarl 3y agoNo, iptables is a perfectly functional nftables frontend
- systems_glitch 3y agoNot having to manage two rulesets -- one for IPv4 and one for IPv6 -- is pretty well a killer feature in my mind.
- nolist_policy 3y agonftables is now almost 10 years old! It's time to forget the bad experiences with iptables.
- systems_glitch 3y agoI have -- I let the OpenBSD firewalls take care of it :P Seriously though it's something I need to get familiar with, I do still have plenty of Linux boxes that face the public Internet and are currently dependent on iptables/ip6tables rulesets. The problem is I'm currently masking that pain with Ansible.