LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-08-2019, 06:41 AM   #1
bartgrefte
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Rep: Reputation: Disabled
switching from ip(6)tables to nftables


I've been using a computer as a router for over a decade, currently I'm using a very clean install of Debian 9 with ip(6)tables for that. If I update it to Debian 10, nftables will become the standard firewall.

Since I'm new with nftables (though I've read quite a bit), what would be the best way to switch from ip(6)tables to nftables?

Last edited by bartgrefte; 08-08-2019 at 08:45 AM.
 
Old 08-10-2019, 11:38 AM   #2
Corvette
Member
 
Registered: Jul 2017
Location: Missouri, United States
Distribution: Debian 9
Posts: 110

Rep: Reputation: 24
You may have already looked at it, but I would simply advise following the advice provided in the nftables wiki: https://wiki.nftables.org/wiki-nftab...es_to_nftables
 
Old 08-14-2019, 08:23 AM   #3
bartgrefte
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Corvette View Post
You may have already looked at it, but I would simply advise following the advice provided in the nftables wiki: https://wiki.nftables.org/wiki-nftab...es_to_nftables
Unfortunately the translation tool doesn't recognize everything, something as simple as -P INPUT DROP for example, iptables-translate doesn't have a clue... The forwarding ports rules are translated without problems.

This morning I installed Debian Buster in a virtual machine, for some reason it still accepts iptables rules, thought nftables was default.

Last edited by bartgrefte; 08-14-2019 at 08:25 AM.
 
Old 08-14-2019, 11:20 AM   #4
permaroot
Member
 
Registered: Aug 2019
Location: Arden, NC
Distribution: Manjaro, Centos7, Arch
Posts: 105

Rep: Reputation: 46
Quote:
Originally Posted by bartgrefte View Post
Unfortunately the translation tool doesn't recognize everything, something as simple as -P INPUT DROP for example, iptables-translate doesn't have a clue... The forwarding ports rules are translated without problems.

This morning I installed Debian Buster in a virtual machine, for some reason it still accepts iptables rules, thought nftables was default.
You can definitely still use iptables if you don’t want to learn nftables. The syntax is much different as you know but if your iptables config works, why change it?

If I’m not mistaken the biggest difference (aside from syntax of course) is that nftables includes arptables, ipv6tables and ebtables. Unless you’re using those other ones and having to configure those apart from iptables I see no huge advantage in switching. But I’m not super familiar with what else nftables does that iptables doesn’t.
 
Old 08-16-2019, 07:17 AM   #5
bartgrefte
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by permaroot View Post
You can definitely still use iptables if you don’t want to learn nftables. The syntax is much different as you know but if your iptables config works, why change it?
Well, if nftables ends up becoming the only option at some point, I might as well be prepared. Otherwise I would just be postponing the switch.

Anyway, I think I've found nftables-translations for all the rules, now I just have to figure out how to put every thing together. Since it's not a client firewall but for a router, it seems I need tables for ip, ip6 and nat. Using inet seems pointless since IPv4 and IPv6 don't use the same interface, got an IPv6-tunnel.

edit: Hmm, found a command that saves the rules into the file that's automatically loaded when nftables is, but keep getting permission denied:
Code:
nft list ruleset > /etc/nftables.conf
(sudo doesn't make a difference)

edit2: Rewrote that to
Code:
sudo sh -c “nft list ruleset > /etc/nftables.conf”
See https://stackoverflow.com/questions/...le-doesnt-work

Last edited by bartgrefte; 08-17-2019 at 06:36 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Nftables rules and tables dissapiered after reboot! OlgaM Linux - Security 7 03-05-2019 11:20 AM
LXer: Tables of Contents, Indexes and Other Special Tables in Scribus LXer Syndicated Linux News 0 05-13-2011 05:30 AM
LXer: Linux: First Release Of nftables LXer Syndicated Linux News 0 04-02-2010 06:00 AM
LXer: This week at LWN: Nftables: a new packet filtering engine LXer Syndicated Linux News 0 04-09-2009 09:40 AM
LXer: New Kernel Firewall Nftables to Succeed Netfilter LXer Syndicated Linux News 0 03-21-2009 11:50 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:03 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration