Re: using nft & iptables nat in parallel

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > That still means drastic change, swapping out xt_core for nftables
> > rather than using "old" iptables is still a big difference...
> 
> Not drastic. The idea is that compat provides same semantics. Did you
> give it a try to evaluate the state of this?

Not yet.

> The extra hook has a performance impact though, is it something that
> would just go away one x_tables is gone? What is your plan on this?

Once we do it we can't remove it again, because you can have multiple
nat base chains after this change, and removing hook and merging it back
into the l3 nat code means first chain attaches a null binding again.

> On a different front (just an idea), I would really like to provide an
> alternative to setting conntrack templates, so we can get rid of
> having a chain (hence another hook) just to set the zone. It's just
> more cycles on a hook to do something very simple.

I don't think it can be done, the zone id has to be set before conntrack
lookup, I see no way to avoid this?

So even if we find a way to transport zone id from one hook to the
next (sans skb->nfct template) we still need one extra hook to
configure/set the zone id to use.