Fedora 32 Looking At Switching Firewalld From Iptables To Nftables

[tildearrow]

faster performance

I thought these were shared? (e.g. adding a rule with iptables and deleting it with nft)

[tildearrow]

Nice.

It is long overdue for nftables to get some wider adoption.

nft add comment inet mytable {
"I will never get used to nftables..."
}

[Weasel]

Thanks for re-jogging my memory, I remember reading that article when it came out. Any news in the subsequent 1½ years since it was written, except that bpfilter was apparently merged for 4.18?

Yeah I'm curious too.

[starshipeleven]

I don't get why somebody wants to change iptables or netfilter, by some crap..

faster performance

[q2dg]

I don't get why somebody wants to change iptables or netfilter, by some crap..

Because nftables IS netfiler, ignorant

[tuxd3v]

I don't get why somebody wants to change iptables or netfilter, by some crap..

[oibaf]

What happens with docker/libvirt? They still don't use nftables and you can't mix iptables and nftables rules. How did they solve this issue in RHEL8?

You can, if you use iptables with the new -nft backend, which is the default since Debian 10 and RHEL 8.

[darkbasic]

What happens with docker/libvirt? They still don't use nftables and you can't mix iptables and nftables rules. How did they solve this issue in RHEL8?

[jabl]

https://old.lwn.net/Articles/747551/

Thanks for re-jogging my memory, I remember reading that article when it came out. Any news in the subsequent 1½ years since it was written, except that bpfilter was apparently merged for 4.18?

[starshipeleven]

Wasn't there some discussion on lkml some time ago that the future is eBPF and XDP, and that nftables is a failed experiment with little usage? And somebody had created some kind of iptables implementation that in fact compiled the rules to eBPF (bpfilter). But subsequently I've heard little of it, and it seems that distros are slowly starting to switch over to nftables. What gives?

https://old.lwn.net/Articles/747551/