Re: Upgrading libnetfilter_queue to use nftables

[trentbuck@gmail.com (Trent W. Buck)]

Alessandro Vesely <vesely@tana.it> writes:

> On Thu 14/Nov/2019 04:12:46 +0100 Florian Westphal wrote:
>> Alessandro Vesely <vesely@tana.it> wrote:
>>> [...]
>>> There is a user space filter reading queued packets and issuing verdicts.
>>> It is linked to libnetfilter_queue, libnfnetlink and libmnl.
>>> Does automatic translation work fine in this case?
>>
>> It has nothing to do with translation, userspace doesn't care, its the
>> same interface.
>
> So it shouldn't even be needed to maintain alternatives like Debian does, e.g.:
>
> # update-alternatives --set iptables /usr/sbin/iptables-nft
> vs
> # update-alternatives --set iptables /usr/sbin/iptables-legacy

nft doesn't support some things (e.g. -j TARPIT from xtables-addons-dkms).
iptables-legacy lets you continue using those things.

You also need the -legacy tools to inspect firewall rules created by
e.g. systemd-nspawn for systemd containers.

Here is an example system with a single nft rule AND a single legacy
rule created by systemd:

    root@not-omega:~# iptables-save
    # Warning: iptables-legacy tables present, use iptables-legacy-save to see them

    root@not-omega:~# iptables-legacy-save
    # Generated by iptables-save v1.8.3 on Mon Nov 18 11:48:26 2019
    *nat
    :PREROUTING ACCEPT [111429:8069436]
    :INPUT ACCEPT [111423:8067363]
    :OUTPUT ACCEPT [38839:3454394]
    :POSTROUTING ACCEPT [38837:3454330]
    -A POSTROUTING -s 10.194.71.0/24 -j MASQUERADE
    COMMIT
    # Completed on Mon Nov 18 11:48:26 2019

    root@not-omega:~# nft list ruleset
    table inet filter {
            chain input {
                    type filter hook input priority filter; policy accept;
                    counter packets 9 bytes 632 continue comment "example rule that does nothing"
            }

            chain forward {
                    type filter hook forward priority filter; policy accept;
            }

            chain output {
                    type filter hook output priority filter; policy accept;
            }
    }


PS: I'm 95% sure I've seen iptables-restore silently fail to load SOME
rules leaving me with a wrong ruleset instead of a right ruleset or the
existing ruleset.  And then iptables-legacy-restore worked fine.
(I'd give the actual code, but it was a few weeks ago and I don't have
it handy.)