Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Wed, Jun 14, 2017 at 11:58:03AM +0200, Florian Westphal wrote: > > Arturo Borrero Gonzalez <arturo@xxxxxxxxxx> wrote: > > > I'm curious, What is the use case of using both nftables and iptables > > > at the same time? > > > Some missing functionality in nft? > > > Perhaps some ipt->nft partial migration procedure? > > > > Yes, partial migration. > > > > Right now there are an awful lot of tools out there (docker, libvirt, > > kubernetes, ..) that call iptables(-restore) directly (or inject them via > > firewalld). > > > > And unfortunately I don't see how we can magically move all of this > > to nftables. > > > > So allowing to do a step-by-step migration seems the only viable > > option. > > We have iptables-compat-restore, this uses the nf_tables netlink > frontend and packet classification code, plus x_tables extensions to > run iptables code. It should allow us to schedule the x_tables core > for removal at some point. Yes, perhaps. > In Montpellier, we mentioned that distro could add a iptables-restore > symlink to iptables-compat-restore so it becomes visible that we're > relying on the compat infrastructure. > > This iptables-compat-restore interacts with nft via translate layer, > so if you just 'nft list ruleset' after using iptables-compat-restore, > you will get a translation (if available). That still means drastic change, swapping out xt_core for nftables rather than using "old" iptables is still a big difference... I also think that ability to use both iptables or nftables nat is a good thing, since it lowers barrier to 'just try it' without having to unload iptable_nat and friends. Also forgot to mention: this will allow to use nat base chains in multiple tables (even though it is probably not a good idea to do that due to possible problems because of unexpected/different evaluation order). -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
