nftables is iptables' successor:
I do wish they'd just adopted the PF syntax tho. It really is the gold standard for stateful firewall definition
Was anyone involved in the discussions around the creation of nftables that can comment on whether this was considered?
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page#...
None of these is anything like a tutorial or introduction. "Quick reference, nftables in 10 minutes" claims to be a ten-minute guide but it's actually just an information dump without any guidance.
Some highlights: "matches are clues used to access to certain packet information and create filters according to them." My translation: "Matches are conditions for rules to apply. They match certain properties (hyperlink) of packets."
"position is an internal number that is used to insert a rule before a certain handle." My translation: "position is an index into the list of rules. It can be used to insert rules at a given position in the list."
I don't know if my translations are correct due to the absurdly bad originals. It is like the authors explain verbs without explaining the nouns they act on. For the nouns, there are mostly just tables of them without any explanation at all. In other places, the few most important nouns are explained.
This alien logic is not only in the documentation, it is also in the syntax. Nobody I know thinks like that.
For reference: https://wiki.nftables.org/wiki-nftables/index.php/Multiple_N...
It does look nicer when properly formatted as part of a rule file, however.
The docs needs some work.
It is a bit hit and miss with kernel/nftables versions on release distributions. I probably would not use it with any kernels older than 4.10 for example. So any current LTS kernel is out.
https://wiki.nftables.org/wiki-nftables/index.php/Main_diffe...