23 Nov
2018
23 Nov
'18
2:26 p.m.
I'm not sure how many people have made the transition from iptables to
nftables.
I have just done so on one VPS, had a couple of minor hiccups on the way
but am very pleased with the result. Easy to do and the much more
human-readable and simplified syntax make it easy to read and maintain. I
particularly like the way that you just write one set of rules for ipv4 and
ipv6 and that as sets are built in it avoids all the problems involved in
making a table with sets reboot safe.
I was toying with doing a wiki page to share the experience and tips that I
picked up, but wiki syntax seems harder to fathom than nftables syntax. I
did a lot of googling on the issue but many of the How-To sites were either
contradictory, totally missing the new features (iptables rules translated
line by line and not taking advantage of new features), downright wrong or
rip-off copies of official documentation.
Keith
23 Nov
23 Nov
2:56 p.m.
Hi Keith,
On Fri, Nov 23, 2018 at 10:26:17PM +0800, Keith Williams wrote:
I was toying with doing a wiki page to share the
experience and tips that I
picked up,
I for one would be very interested in seeing what you have done as I
haven't had chance to look into nftables at all yet, but know I will
have to at some point.
but wiki syntax seems harder to fathom than nftables
syntax.
The most important thing is the content so I would advise just
dumping it into a page as plain text and worrying about the
formatting later.
Ideally if you could wrap text that is supposed to be resemble code,
configuration files or shell sessions with:
<syntaxhighlight lang="text">
</syntaxhighlight>
then that will look better. If you can't remember that, just
<pre></pre> will at least be monospaced and without HTML formatting.
For anything else more advanced, the wiki is a Mediawiki install, so
look for guides on Mediawiki formatting.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
2:58 p.m.
I'll have a bash this weekend then
On Fri, 23 Nov 2018 at 22:57, Andy Smith <andy(a)bitfolk.com> wrote:
Hi Keith,
On Fri, Nov 23, 2018 at 10:26:17PM +0800, Keith Williams wrote:
I was toying with doing a wiki page to share the
experience and tips
that I
picked up,
I for one would be very interested in seeing what you have done as I
haven't had chance to look into nftables at all yet, but know I will
have to at some point.
but wiki syntax seems harder to fathom than
nftables syntax.
The most important thing is the content so I would advise just
dumping it into a page as plain text and worrying about the
formatting later.
Ideally if you could wrap text that is supposed to be resemble code,
configuration files or shell sessions with:
<syntaxhighlight lang="text">
</syntaxhighlight>
then that will look better. If you can't remember that, just
<pre></pre> will at least be monospaced and without HTML formatting.
For anything else more advanced, the wiki is a Mediawiki install, so
look for guides on Mediawiki formatting.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
6:11 p.m.
On Fri, Nov 23, 2018 at 10:26:17PM +0800, Keith Williams wrote:
I'm not sure how many people have made the
transition from iptables to
nftables.
Not done so yet.
I have just done so on one VPS, had a couple of minor
hiccups on the way
but am very pleased with the result. Easy to do and the much more
human-readable and simplified syntax make it easy to read and maintain. I
particularly like the way that you just write one set of rules for ipv4 and
ipv6 and that as sets are built in it avoids all the problems involved in
making a table with sets reboot safe.
The syntax is appealing. It mimics 'pf' which I found very easy to read.
nftables seemed to a bit behind iptables, I could be wrong, if they're
at the same capability level now then I think maintaining iptables would
be less desirable. Might have been dreaming, did RH say they were were
going to use nftables for the next release?
iptables has been around an awfully long time, migration will be hard
for most people, I for one reject most forms of change! :)
--
Best regards,
Ed http://www.s5h.net/
7:12 p.m.
On 23 Nov 2018, at 18:11, Ed <ed-bitfolk(a)s5h.net> wrote:
The syntax is appealing. It mimics 'pf' which
I found very easy to read.
nftables seemed to a bit behind iptables, I could be wrong, if they're
at the same capability level now then I think maintaining iptables would
be less desirable. Might have been dreaming, did RH say they were were
going to use nftables for the next release?
It’s already in at least RHEL 7.6 (and, therefore, CentOS 7.6). It’s used underneath
firewalld, but can be used by itself, too.
Cheers,
Mike
8:26 p.m.
It's already there for Debian 9. Recent Kernels actually use the NFT engine
to operate IPTables as RHEL does. From the next release of Debian NFT will
replace IPTables. One of the beauties of nftables is that you handle ipv4
and ipv6 in the same tables. No repetition of rules, and of course, with
multiple verdicts on each rule, fewer rules easier to read. So you can have
a rule that says if the condition is met, log it, put the IP in a set and
then drop it. It can do all that IPTables can and more. Sets are now native
so no need to faf around with ipsets. It covers and replaces all the
xtables family IPTables, ARPTables etc.
I am impressed with it.
On Sat, 24 Nov 2018 at 03:13, Mike Zanker <mike(a)zanker.uk> wrote:
On 23 Nov 2018, at 18:11, Ed
<ed-bitfolk(a)s5h.net> wrote:
The syntax is appealing. It mimics 'pf'
which I found very easy to read.
nftables seemed to a bit behind iptables, I could be wrong, if they're
at the same capability level now then I think maintaining iptables would
be less desirable. Might have been dreaming, did RH say they were were
going to use nftables for the next release?
It’s already in at least RHEL 7.6 (and, therefore, CentOS 7.6). It’s used
underneath firewalld, but can be used by itself, too.
Cheers,
Mike
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
24 Nov
24 Nov
4:39 a.m.
I have put the first part of the wiki article up, still a lot to write
though. Will add more later, aiming to finish by the end of the weekend. I
am in the GMT + 8 timezone and it is time for siesta (and being a weekend,
a beer as well)
On Fri, 23 Nov 2018 at 22:26, Keith Williams <keithwilliamsnp(a)gmail.com>
wrote:
I'm not sure how many people have made the
transition from iptables to
nftables.
I have just done so on one VPS, had a couple of minor hiccups on the way
but am very pleased with the result. Easy to do and the much more
human-readable and simplified syntax make it easy to read and maintain. I
particularly like the way that you just write one set of rules for ipv4 and
ipv6 and that as sets are built in it avoids all the problems involved in
making a table with sets reboot safe.
I was toying with doing a wiki page to share the experience and tips that
I picked up, but wiki syntax seems harder to fathom than nftables syntax. I
did a lot of googling on the issue but many of the How-To sites were either
contradictory, totally missing the new features (iptables rules translated
line by line and not taking advantage of new features), downright wrong or
rip-off copies of official documentation.
Keith
8:36 a.m.
On Sat, 24 Nov 2018 12:39:12 +0800
Keith Williams <keithwilliamsnp(a)gmail.com> wrote:
I have put the first part of the wiki article up,
still a lot to write
though. Will add more later, aiming to finish by the end of the
weekend. I am in the GMT + 8 timezone and it is time for siesta (and
being a weekend, a beer as well)
There are already several wikis for nftables:-
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_n…
and a Debian specific one (plus other distro specific ones)
https://wiki.debian.org/nftables
--
John Lewis
10:02 a.m.
Yes there are. But not on the Bitfolk wiki. I have also found errors on
each one of them or outdated information. , so I am attempting to document
my journey through these to achieve a working nftables firewall utilising
the new features with minimum code. There are many routes to the goal. The
official wiki, for example, gives some example code which even if copied
and pasted is rejected by nft. It also recommends one particular method of
adding rulesets whilst discouraging another method, then because many of
the pages are out of date uses the "bad" method. Nft is evolving quite
fast, but some parts of the already published information has been left
behind.
If nothing else it will give another choice to people wanting to try it
On Sat, 24 Nov 2018 at 16:37, john lewis <zen57162(a)zen.co.uk> wrote:
On Sat, 24 Nov 2018 12:39:12 +0800
Keith Williams <keithwilliamsnp(a)gmail.com> wrote:
I have put the first part of the wiki article up,
still a lot to write
though. Will add more later, aiming to finish by the end of the
weekend. I am in the GMT + 8 timezone and it is time for siesta (and
being a weekend, a beer as well)
There are already several wikis for nftables:-
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_n…
and a Debian specific one (plus other distro specific ones)
https://wiki.debian.org/nftables
--
John Lewis
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
10:13 a.m.
The iptables to nftables converter programs are an interesting case in
point. They merely change the syntax in existing rules, no combining ipv4
and ipv6 for example - so there is duplication there within a lot of the
ruleset and the very real dangers in maintenance of missing some edits.
Some rules cannot be directly translated programmatically. I came across an
interesting article by a guy converting. He used the software and then had
to spend as long reediting to make it work as he would have done starting
from scratch. And still ended up with separate tables for ipv4 and ipv6.
As I said I am merely offering a different viewpoint and approach that
might help someone
On Sat, 24 Nov 2018 at 18:02, Keith Williams <keithwilliamsnp(a)gmail.com>
wrote:
Yes there are. But not on the Bitfolk wiki. I have
also found errors on
each one of them or outdated information. , so I am attempting to document
my journey through these to achieve a working nftables firewall utilising
the new features with minimum code. There are many routes to the goal. The
official wiki, for example, gives some example code which even if copied
and pasted is rejected by nft. It also recommends one particular method of
adding rulesets whilst discouraging another method, then because many of
the pages are out of date uses the "bad" method. Nft is evolving quite
fast, but some parts of the already published information has been left
behind.
If nothing else it will give another choice to people wanting to try it
On Sat, 24 Nov 2018 at 16:37, john lewis <zen57162(a)zen.co.uk> wrote:
On Sat, 24 Nov 2018 12:39:12 +0800
Keith Williams <keithwilliamsnp(a)gmail.com> wrote:
I have put the first part of the wiki article up,
still a lot to write
though. Will add more later, aiming to finish by the end of the
weekend. I am in the GMT + 8 timezone and it is time for siesta (and
being a weekend, a beer as well)
There are already several wikis for nftables:-
https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_n…
and a Debian specific one (plus other distro specific ones)
https://wiki.debian.org/nftables
--
John Lewis
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
25 Nov
25 Nov
8:41 a.m.
On Sat, 24 Nov 2018 18:13:10 +0800
Keith Williams <keithwilliamsnp(a)gmail.com> wrote:
The iptables to nftables converter programs are an
interesting case in
point. They merely change the syntax in existing rules, no combining
ipv4 and ipv6 for example - so there is duplication there within a
lot of the ruleset and the very real dangers in maintenance of
missing some edits. Some rules cannot be directly translated
programmatically. I came across an interesting article by a guy
converting. He used the software and then had to spend as long
reediting to make it work as he would have done starting from
scratch. And still ended up with separate tables for ipv4 and ipv6.
As I said I am merely offering a different viewpoint and approach
that might help someone
OK, I wasn't aware the wikis I mentioned were out of date. I did
install nftables on my laptop and used the example workstation.nft
provided by Debian to set it up. Can I now remove iptables?, I hadn't
bothered setting it up as my laptop doesn't 'roam' public networks.
9:43 a.m.
Not sure if it is possible to remove iptables as such. Basically they both
run on the same underlying infrastructure. I flushed all tables set all
policies to accept then removed the various references to iptables when
booting (pre-up and pre-down). I also managed to get fail2ban working with
nftables (ipv4 at least)
On Sun, 25 Nov 2018 at 16:42, john lewis <zen57162(a)zen.co.uk> wrote:
On Sat, 24 Nov 2018 18:13:10 +0800
Keith Williams <keithwilliamsnp(a)gmail.com> wrote:
The iptables to nftables converter programs are
an interesting case in
point. They merely change the syntax in existing rules, no combining
ipv4 and ipv6 for example - so there is duplication there within a
lot of the ruleset and the very real dangers in maintenance of
missing some edits. Some rules cannot be directly translated
programmatically. I came across an interesting article by a guy
converting. He used the software and then had to spend as long
reediting to make it work as he would have done starting from
scratch. And still ended up with separate tables for ipv4 and ipv6.
As I said I am merely offering a different viewpoint and approach
that might help someone
OK, I wasn't aware the wikis I mentioned were out of date. I did
install nftables on my laptop and used the example workstation.nft
provided by Debian to set it up. Can I now remove iptables?, I hadn't
bothered setting it up as my laptop doesn't 'roam' public networks.
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
1988
days inactive
1990
days old
11 comments
5 participants
participants (5)
-
Andy Smith -
Ed -
john lewis -
Keith Williams -
Mike Zanker