Hacker News Reader

Comment by joosters | Hacker News Reader

These are all very kernel-orientated improvements. My guess is that a 'common' user (whatever that may be), cares very little about the efficiency or improved storage benefits of a new firewall command.

As for users with poorly configured iptables, fair enough but the latest and greatest new firewall toolset will give ample opportunity to create new poorly configured nftables too.

This is all coming from a bitter old sysadmin who has had to re-tool through ipfwadm, ipchains and iptables, and who knows what else in the coming future. I'm sure each iteration has brought improvements to newer setups and advanced networking, but this smells like just another "let's re-write some tools" project.

View on HN

    ipfwadm - pre 1996 (I think?)
    ipchains - pre 1998 according to wikipedia
    iptables - 1998 according to wikipedia
    nftables - 2014

More churn than javascript frameworks.

Realistically iptables isn't going anywhere, though I'm def looking forward to nftables being more widely used. My main interest is around the newer setups and advanced networking, but if you're not dealing with one of them, then you 1) probably won't have to port anything to nftables this decade, and 2) could probably get away with using a higher level tool like UFW

Plus, current iptables runs on top of nftables, doesn't it?

iptables the kernel component might run on top of netfilter (i.e. there are various `nf_` modules loaded in my kernel, some of which are being used by `iptables_` modules), though I doubt iptables the user space component relies on ntf/nftables the user space component. Could be wrong I guess (comment and I shall edit this out if I'm wrong)

As an aside, that's one of the nice things about nftables. No more conflating the user space binary, the user space format, the kernel module and so on.

My understanding is that iptables and nftables are both user interfaces to configure rule-sets in the NetFilter code, though I think that glosses over some important bits.

> More churn than javascript frameworks.

4 in 20 years. No.

I believe the poster you are replying to meant that with a touch of sarcasm.

Blatant sarcasm.

I can't really speak to nftables, as I've only used it in passing once or twice (I don't do nearly as much sysadmin work anymore), but once you've experienced OpenBSD's PF it becomes immediately obvious how poor of an abstraction iptables is. Anything which brings the Linux firewall capabilities and configuration closer to what is achieved through PF is a good thing in my book, and from what I've gleaned nftables goes some way towards this.

Reply on news.ycombinator.com