Hacker News Reader

Comment by SwellJoe | Hacker News Reader

My fingers still type ifconfig, netstat, and route, and then I correct myself usually before hitting enter (though that took at least a couple of years). The new commands are more consistent, and more logically laid out so I can't argue against switching...but, my muscle memory doesn't know them yet (despite having started switching years ago).

It seems pretty clear unlearning the old and learning the new is more work than learning it for the first time, which may be why so many old-timers are so disagreeable to changes like this, even if the new is clearly superior (and for the average user, these may not be clearly superior enough to justify extra effort). Hell, I caught myself typing an ipchains command a week or so ago (while I'm busy learning about nftables which replaces iptables/ip6tables!), and I haven't had a system that had ipchains in more than a decade.

View on HN

is nftables production ready ? or is everyone still at iptables/ipchains ?

You're fine sticking with iptables for now, if you don't experience any pain from it. ipchains has been compltely dead for well over a decade (which is why it's so ridiculous that I'd start typing an ipchains command); iptables arrived in 2001 and was on everything by the mid-2000s. The difference with that transition was that you couldn't keep using ipchains, because it was replaced by iptables. nftables co-exists with iptables.

nftables works well and has been available in mainline Linux for a few years, but there's little support for it at the distribution and tools and documentation level. AFAIK, things like firewalld and other firewall management tools don't support it yet (though firewalld will support it transparently when it does arrive, so if you use firewalld to manage your iptables firewalls, it'll probably Just Work when switching to nftables). We don't yet support it in our products (while we do support firewalld, iptables, and some third party firewall management tools like CSF have modules for Webmin).

iptables continues to be supported at all levels, so there is no urgency to switching, though nftables is clearly superior in nearly every way. It's an awesome tool, but adoption has been very, very slow. I think that's unfortunate, as it's an area where I'd be willing to learn new things. nft has really clean syntax with super powerful abstractions and hooks into the kernel.

So, if you manage a lot of Linux firewalls, or a few very complex ones, maybe you want to switch already...I would, if I were in that situation. But, I just use firewalld, because my firewall needs are minimal these days.

do you see a python 2 -> python 3 situation happening with nftables ? because that is a shame.

I personally cant wait for pfsense quality products to come on Linux.

I think Linux is just such a big ecosystem now, with such a huge variety of dependent parties, that nothing can change fast anymore, and nothing can ever die. So many products are built around iptables, so many docs assume iptables, etc. It's just cheaper for people to keep using iptables. Doing an ipchains->iptables style conversion where the next version of Linux just completely removed the old thing, wouldn't be feasible today. Linux is orders of magnitude bigger than it was from the transition 2.2 to 2.4 (I think that was when the iptables switch happened).

It's "only" been four years since nftables made it to mainline kernel, so we're not quite into Python 3 territory, but I wouldn't be surprised if we're still having this conversation in five more years. There's just no movement toward nftables, at all, that I perceive. I think it's partly because firewalls matter less today than they once did. So much is in the cloud now, where the firewall is somebody else's problem. It might even end up being a Perl 5->6 situation, but we won't know for a few more years.

What do you think of ufw? It's native to Ubuntu, but it's also in Debian and Fedora (just checked the latter with Docker). I chose it over firewalld for my simple firewall needs because I run Debian and Ubuntu rather than Fedora and CentOS, and there's no daemon in ufw, so IMO it's simpler.

Now if we can just teach the Internet how to unlearn.

Go ahead, search with your favorite web crawler. Something simple like "command line ip address".

It will tell you to use ifconfig -a.

Reply on news.ycombinator.com