Alessandro Vesely <vesely@xxxxxxx> writes:
> On Thu 14/Nov/2019 04:12:46 +0100 Florian Westphal wrote:
>> Alessandro Vesely <vesely@xxxxxxx> wrote:
>>> [...]
>>> There is a user space filter reading queued packets and issuing verdicts.
>>> It is linked to libnetfilter_queue, libnfnetlink and libmnl.
>>> Does automatic translation work fine in this case?
>>
>> It has nothing to do with translation, userspace doesn't care, its the
>> same interface.
>
> So it shouldn't even be needed to maintain alternatives like Debian does, e.g.:
>
> # update-alternatives --set iptables /usr/sbin/iptables-nft
> vs
> # update-alternatives --set iptables /usr/sbin/iptables-legacy
nft doesn't support some things (e.g. -j TARPIT from xtables-addons-dkms).
iptables-legacy lets you continue using those things.
You also need the -legacy tools to inspect firewall rules created by
e.g. systemd-nspawn for systemd containers.
Here is an example system with a single nft rule AND a single legacy
rule created by systemd:
root@not-omega:~# iptables-save
# Warning: iptables-legacy tables present, use iptables-legacy-save to see them
root@not-omega:~# iptables-legacy-save
# Generated by iptables-save v1.8.3 on Mon Nov 18 11:48:26 2019
*nat
:PREROUTING ACCEPT [111429:8069436]
:INPUT ACCEPT [111423:8067363]
:OUTPUT ACCEPT [38839:3454394]
:POSTROUTING ACCEPT [38837:3454330]
-A POSTROUTING -s 10.194.71.0/24 -j MASQUERADE
COMMIT
# Completed on Mon Nov 18 11:48:26 2019
root@not-omega:~# nft list ruleset
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
counter packets 9 bytes 632 continue comment "example rule that does nothing"
}
chain forward {
type filter hook forward priority filter; policy accept;
}
chain output {
type filter hook output priority filter; policy accept;
}
}
PS: I'm 95% sure I've seen iptables-restore silently fail to load SOME
rules leaving me with a wrong ruleset instead of a right ruleset or the
existing ruleset. And then iptables-legacy-restore worked fine.
(I'd give the actual code, but it was a few weeks ago and I don't have
it handy.)
