Re: ipset vs. nftables set

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Nov 12, 2024 at 07:44:17PM +0000, Kerin Millar wrote:
> On Tue, 12 Nov 2024, at 6:18 PM, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> >> > But one can have multiple hooks (chains) in one table, even with the
> >> > same priority (i not suggest that). Thus one can combine multiple
> >> > tables into one and share sets, eg. in raw & filter hooks.
> >> 
> >> Don't do that, please.
> >
> > Why not?  Single-table approach makes sense, in my opinion,
> > provided that single table is controlled by single entity, be
> > that a program like firewalld or traditional sysadmin.
> >
> > With multi-table things become awkward due to the imposed
> > scoping rules that prevent cross-table use of sets/maps.
> 
> I read it as being an objection to (potentially) using hooks that
> duplicate one another exactly. Mind you, if it be considered so
> objectionable, why doesn't nft refuse to compile rulesets that do
> this? Or, at least, raise a warning.

A warning to what? example?