Thank you. I actually found a set instructions online for converting iptables rules to nft rules using iptables-restore-translate. It had me save the current iptables config, translate it, flush the ruleset, then import the new commands into nft, but it threw errors on the security filter commands, and failed to bring in my specific INPUT rules, so I just flushed the ruleset, restored my iptables config, and then disabled iptables :) I did compare the iptables save file and the nft translation, and the nft rules read a little like Cisco- or MikroTik-style configuration commands. I'll figure out nft and start using that. Again, very appreciative of your time. Jeff -----Original Message----- From: Kerin Millar <kfm@xxxxxxxxxxxxx> Sent: Saturday, October 2, 2021 9:36 PM To: Jeff <jnewman67@xxxxxxx> Cc: netfilter@xxxxxxxxxxxxxxx Subject: Re: netfilter 10,000' overview (re-copying the list into CC ...) On Sat, 2 Oct 2021 21:22:46 -0400 "Jeff" <jnewman67@xxxxxxx> wrote: [...] > Looking at the Redhat article you linked to, it appears that Fedora > implements nftables under iptables, which I assume affect the > nf_tables ruleset. However, it mentions the inclusion of xtables > utilities, but it appears those are just used to convert xtable-like > rules compatible with nf_tables. So it appears nf_tables is the underlying ruleset. Since Fedora 32, apparently. https://fedoraproject.org/wiki/Changes/iptables-nft-default On such a system, you may find it interesting to compare the output of "iptables-save" and "nft list ruleset". > > I'll do some learning on how to make rules in nftables, and get some > of my scripts converted over, and see how I get along. See, also, "iptables-translate" and "iptables-restore-translate". While not perfect, they are definitely useful. > > If I got anything wrong in this response, I'd appreciate knowing. > Otherwise, I really do appreciate your time, and I'll leave you to > what must be much more important things :) > > Jeff -- Kerin Millar
