Hello,
Suppose you have written a lot of iptables rules and now you want to edit some lines or a specific value. If you save the rules in a file using the iptables-save command and then edit it and restore it again using the iptables-restore command. Is this method correct?


Thank you.

That method works.

However, if you are getting started, I'd highly encourage looking at NFTables instead because it is much easier to work with. In this case, you'd just edit the NFTables configuration file and then reload it. Also, IPTables is already a thing of the past and getting further out of date as time passes. It's going to go away and you'll move to NFTables at that point anyway. So the time and learning invested in IPTables is kind of a lost cause at this point.

1 members found this post helpful.

Hello,
Thank you so much for your reply and offer.
It is true that NFTables is a replacement for iptables, but do you think this will happen soon? There is also a command called iptables-nft to translate iptables commands to NFTables. I guess at the current stage, iptables is more mature than NFTables.

For me and many others, NFTables has already replaced IPTables. So I would say the replacement has already happened.

I made the switch some years ago already (perhaps five) because IPTables did not support some of the activities I needed in networking. Since most development on IPTables was abandoned long ago, I would say that NFTables is now the mature technology and that IPtables is legacy software to be decommissioned from old systems when feasible, upon system upgrade at the latest. At this point time spent on IPTables will not provide a good return on the effort.

Conversion programs were not so useful for me so I went to native NFTables as soon as I could.

These two links seem to be the best starting place:

https://wiki.nftables.org/
https://wiki.nftables.org/wiki-nftab..._in_10_minutes

1 members found this post helpful.

Hello,
Thanks again.
Can you tell me what problems the conversion programs gave you?

I found that they were not useful more often than not. Repairing their output took time and instead I invested that time in NFTables. It did not take long to learn NFTables. For me it turned out easier to learn than IPTables even though I have been dabbling with IPTables since its beginning.

1 members found this post helpful.

I wrote a firewall script that blocks a few known problem areas of the net and does some other things. I can ban a host with it, and I set options to save and restore the state of iptables as functions in the shell script. Since it's under RCS, I use that to update the script. When I want to make changes, I change the script.

As far as nftables, if you don't know either iptables nor nftables, then go with nftables as stated. Those of us that learned ipchains^h ebtables^h ip6tables^h iptables aren't happy about having to learn yet another packet filtering syntax, one that looks more like a Java or C++ program than filtering rules. As such, I think iptables will still be around a long time.

1 members found this post helpful.

Hello,
Thank you so much for your reply.
I agree with: