RE: netfilter 10,000' overview

["Jeff" <jnewman67@gmx.com>]

Thank you.

I actually found a set instructions online for converting iptables rules to
nft rules using iptables-restore-translate.  It had me save the current
iptables config, translate it, flush the ruleset, then import the new
commands into nft, but it threw errors on the security filter commands, and
failed to bring in my specific INPUT rules, so I just flushed the ruleset,
restored my iptables config, and then disabled iptables :)

I did compare the iptables save file and the nft translation, and the nft
rules read a little like Cisco- or MikroTik-style configuration commands.

I'll figure out nft and start using that.

Again, very appreciative of your time.

Jeff

-----Original Message-----
From: Kerin Millar <kfm@plushkava.net>
Sent: Saturday, October 2, 2021 9:36 PM
To: Jeff <jnewman67@gmx.com>
Cc: netfilter@vger.kernel.org
Subject: Re: netfilter 10,000' overview

(re-copying the list into CC ...)

On Sat, 2 Oct 2021 21:22:46 -0400
"Jeff" <jnewman67@gmx.com> wrote:

[...]

> Looking at the Redhat article you linked to, it appears that Fedora
> implements nftables under iptables, which I assume affect the
> nf_tables ruleset.  However, it mentions the inclusion of xtables
> utilities, but it appears those are just used to convert xtable-like
> rules compatible with nf_tables.  So it appears nf_tables  is the
underlying ruleset.

Since Fedora 32, apparently.

https://fedoraproject.org/wiki/Changes/iptables-nft-default

On such a system, you may find it interesting to compare the output of
"iptables-save" and "nft list ruleset".

>
> I'll do some learning on how to make rules in nftables, and get some
> of my scripts converted over, and see how I get along.

See, also, "iptables-translate" and "iptables-restore-translate". While not
perfect, they are definitely useful.

>
> If I got anything wrong in this response, I'd appreciate knowing.
> Otherwise, I really do appreciate your time, and I'll leave you to
> what must be much more important things :)
>
> Jeff

--
Kerin Millar