Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by thrwawy74 | Hacker News Reader

Full thread

thrwawy74·

Not to detract from the article, but we should be using nftables in 2022. :-)

https://wiki.nftables.org/wiki-nftables/index.php/Moving_fro...

View on HN

He probably is in a way. iptables is now just a wrapper around nftables and nftables understand the iptables syntax.

Where is that wrapper? In user space or in the kernel?

aiui the iptables-nft wrapper is userspace, it translates iptables syntax into nftables and applies those nftables rules.

I always feel like a git telling people "it's nftables now!", but it's been over a decade and folks keep using iptables as the common identifier. It's slow to change language. You're right, many of those iptables commands are utilities/scripts around nftables now.

Thi is snot very much different from "use IPv6".

I work in IT and it is now probably 25 years that I keep hearing that IPv6 is round the corner. "Adoption" is ~35% but what this means that in 35% of the cases, you can get to a place though IPv6. This does not mean that you must, or do. It is just the capacity.

When a technology takes 25 or so years to be mainstream it means that there is a problem somewhere ("too complicated", ...) or that there is no problem in the forst place ("iptables work fine for me", "I NAT my 10.x network", ...)

If you've set up your rules from scratch using nftables then they are not compatible.

I started with ipfw, then ipchains, then iptables and now nftables. That is just on Linux.

To be fair: I just downloaded a ipfw setup and didn't give it much thought. I spend several weeks hand crafting several ipchains scripts. I spent ages with iptables and wrote a rubbish multi WAN effort and eventually ditched it for pfSense for edge. More ages for a host based effort. I also use ufw quite a bit for iptables. I use firewalld for nftables, these days.

Reply on news.ycombinator.com