Hi Keith, On Fri, Nov 23, 2018 at 10:26:17PM +0800, Keith Williams wrote: that I I for one would be very interested in seeing what you have done as I haven't had chance to look into nftables at all yet, but know I will have to at some point. The most important thing is the content so I would advise just dumping it into a page as plain text and worrying about the formatting later. Ideally if you could wrap text that is supposed to be resemble code, configuration files or shell sessions with: <syntaxhighlight lang="text"> </syntaxhighlight> then that will look better. If you can't remember that, just <pre></pre> will at least be monospaced and without HTML formatting. For anything else more advanced, the wiki is a Mediawiki install, so look for guides on Mediawiki formatting. Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users

The syntax is appealing. It mimics 'pf' which I found very easy to read. nftables seemed to a bit behind iptables, I could be wrong, if they're at the same capability level now then I think maintaining iptables would be less desirable. Might have been dreaming, did RH say they were were going to use nftables for the next release?

I'm not sure how many people have made the transition from iptables to nftables. I have just done so on one VPS, had a couple of minor hiccups on the way but am very pleased with the result. Easy to do and the much more human-readable and simplified syntax make it easy to read and maintain. I particularly like the way that you just write one set of rules for ipv4 and ipv6 and that as sets are built in it avoids all the problems involved in making a table with sets reboot safe. I was toying with doing a wiki page to share the experience and tips that I picked up, but wiki syntax seems harder to fathom than nftables syntax. I did a lot of googling on the issue but many of the How-To sites were either contradictory, totally missing the new features (iptables rules translated line by line and not taking advantage of new features), downright wrong or rip-off copies of official documentation. Keith

On Sat, 24 Nov 2018 12:39:12 +0800 Keith Williams &lt;keithwilliamsnp(a)gmail.com&gt; wrote: There are already several wikis for nftables:- https://wiki.nftables.org/wiki-nftables/index.php/Main_Page https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_n… and a Debian specific one (plus other distro specific ones) https://wiki.debian.org/nftables -- John Lewis _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users

The iptables to nftables converter programs are an interesting case in point. They merely change the syntax in existing rules, no combining ipv4 and ipv6 for example - so there is duplication there within a lot of the ruleset and the very real dangers in maintenance of missing some edits. Some rules cannot be directly translated programmatically. I came across an interesting article by a guy converting. He used the software and then had to spend as long reediting to make it work as he would have done starting from scratch. And still ended up with separate tables for ipv4 and ipv6. As I said I am merely offering a different viewpoint and approach that might help someone