Re: using nft & iptables nat in parallel

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Jun 14, 2017 at 11:58:03AM +0200, Florian Westphal wrote:
> > Arturo Borrero Gonzalez <arturo@debian.org> wrote:
> > > I'm curious, What is the use case of using both nftables and iptables
> > > at the same time?
> > > Some missing functionality in nft?
> > > Perhaps some ipt->nft partial migration procedure?
> > 
> > Yes, partial migration.
> > 
> > Right now there are an awful lot of tools out there (docker, libvirt,
> > kubernetes, ..) that call iptables(-restore) directly (or inject them via
> > firewalld).
> > 
> > And unfortunately I don't see how we can magically move all of this
> > to nftables.
> >
> > So allowing to do a step-by-step migration seems the only viable
> > option.
> 
> We have iptables-compat-restore, this uses the nf_tables netlink
> frontend and packet classification code, plus x_tables extensions to
> run iptables code. It should allow us to schedule the x_tables core
> for removal at some point.

Yes, perhaps.

> In Montpellier, we mentioned that distro could add a iptables-restore
> symlink to iptables-compat-restore so it becomes visible that we're
> relying on the compat infrastructure.
> 
> This iptables-compat-restore interacts with nft via translate layer,
> so if you just 'nft list ruleset' after using iptables-compat-restore,
> you will get a translation (if available).

That still means drastic change, swapping out xt_core for nftables
rather than using "old" iptables is still a big difference...

I also think that ability to use both iptables or nftables nat
is a good thing, since it lowers barrier to 'just try it' without
having to unload iptable_nat and friends.

Also forgot to mention: this will allow to use nat base chains
in multiple tables (even though it is probably not a good idea to do
that due to possible problems because of unexpected/different evaluation
order).