Hacker News Reader

Comment by mgbmtl | Hacker News Reader

I also had my first encounter recently because I bought a new home router and the OpenWRT 22.xx beta now uses nft. Fortunately, the web interface works fine, but I had trouble with IPv6 forwarding, for some reason (I think the default just does not enable it), so had to debug a bit on the command line.

I was annoyed at first, but the transition is easy:

- iptables-translate can help convert rules

- nft avoids having to duplicate ipv4/ipv6 rules

- using the pf syntax and reloading the entire file will avoid reloading if there is a syntax error in a rule (iptables would run as a bash script and have unpredictable results)

- the syntax is fairly similar, but less ugly, similar to tcpdump

View on HN

> using the pf syntax and reloading the entire file will avoid reloading if there is a syntax error in a rule (iptables would run as a bash script and have unpredictable results)

False. iptables-save and iptables-restore does exactly that.

> - the syntax is fairly similar, but less ugly, similar to tcpdump

Also false and especially false and ignorant given the syntax complexity and non-friendliness has been a major complaint of the userbase since NFT's inception. But this isn't a suprise: nft syntax was purposefully designed to be better for computers at the expense of humans. It just happens to be that it's more difficult to write rules for humans, but easier for the interpreter and tools to work with them.

> nft avoids having to duplicate ipv4/ipv6 rules

Sometimes.

    # IPv4 TCP traffic
    ip protocol tcp         reject with tcp reset
    # IPv6 TCP traffic (note: "6" is TCP protocol, not IPv6)
    meta l4proto 6          reject with tcp reset

nftables has some rough API, and to my mind design, edges. It strikes me as being very bottom-up driven--specific kernel rountines and data structures were targetted, and then some kind of API was figured out. The documentation kind of reflects that, too; much more "this is what changed, this is how the flow changes", than "here's how this general goal should be approached."

That said, it works, its an improvement on iptables, and the configuration isn't any worse than iptables. Kernel maintainers really do prefer bottom-up; green-field replacements are frowned on because they're hard to digest and vet.

Reply on news.ycombinator.com