Re: using nft & iptables nat in parallel

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jun 14, 2017 at 11:58:03AM +0200, Florian Westphal wrote:
> Arturo Borrero Gonzalez <arturo@debian.org> wrote:
> > I'm curious, What is the use case of using both nftables and iptables
> > at the same time?
> > Some missing functionality in nft?
> > Perhaps some ipt->nft partial migration procedure?
> 
> Yes, partial migration.
> 
> Right now there are an awful lot of tools out there (docker, libvirt,
> kubernetes, ..) that call iptables(-restore) directly (or inject them via
> firewalld).
> 
> And unfortunately I don't see how we can magically move all of this
> to nftables.
>
> So allowing to do a step-by-step migration seems the only viable
> option.

We have iptables-compat-restore, this uses the nf_tables netlink
frontend and packet classification code, plus x_tables extensions to
run iptables code. It should allow us to schedule the x_tables core
for removal at some point.

In Montpellier, we mentioned that distro could add a iptables-restore
symlink to iptables-compat-restore so it becomes visible that we're
relying on the compat infrastructure.

This iptables-compat-restore interacts with nft via translate layer,
so if you just 'nft list ruleset' after using iptables-compat-restore,
you will get a translation (if available).