Supported features compared to xtables

Last update: Mar/2022

This page tracks the list of supported and unsupported extensions with comments and suggestions.

Unsupported extensions

matches: xt

bpf

• consider native interface

rateest

• consider native interface

string

• consider native interface

u32

• raw expressions?

targets: xt

CHECKSUM

• add nft_payload.
• To the day, the only use case for this was DHCP clients not working with partial checksums. That should be fixed nowadays.
• See https://lwn.net/Articles/396466/ and https://www.spinics.net/lists/kvm/msg37660.html
• See https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/930962 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832090

CT

• nft_ct_target. Refer to Matching_connection_tracking_stateful_metainformation.

IDLETIMER

• consider native interface

LED

• consider native (need this?)

RATEEST

• consider native interface

TCPOPTSTRIP

• consider native interface, need to extend nft_exthdr.c

targets: ipv6

NPT

• consider native interface

targets: bridge

arpreply

• consider native interface

targets: arp

TODO

Supported extensions

matches: xt

addrtype

• nft_fib, starting with 4.10 kernel. Refer to Matching routing information.
• Examples from iptables-translate testsuite

cgroup

• nft_meta. Refer to Quick_reference-nftables_in_10_minutes#Meta.
• Examples from iptables-translate testsuite

[Awaits support for cgroup2]

cluster

• nft_hash
• Examples from iptables-translate testsuite

comment

• Built-in support via NFTA_RULE_USERDATA, since 3.15 (Pablo Neira). Refer to matching UDP/TCP headers in the same rule.
• Examples from iptables-translate testsuite

connbytes

• nft_ct, 4.5 kernel. Refer to Meters.
• Examples from iptables-translate testsuite

connlabel

• nft_meta, since 3.16.
• Examples from iptables-translate testsuite

connlimit

• consider native interface. Refer to Meters.
• Examples from iptables-translate testsuite

connmark

• nft_meta.
• Examples from iptables-translate testsuite

conntrack

• nft_ct.
• Examples from iptables-translate testsuite

cpu

• nft_meta, since 3.18.
• Examples from iptables-translate testsuite

dccp

• nft_payload.
• Examples from iptables-translate testsuite

[Unsupported option : dccp-option]

devgroup

• nft_meta, since 3.18.
• Examples from iptables-translate testsuite

dscp

• nft_payload.
• Examples from iptables-translate testsuite

ecn

• nft_payload.
• Examples from iptables-translate testsuite

esp

• nft_payload.
• Examples from iptables-translate testsuite

hashlimit

• meter statement. Refer to Meters.
• Examples from iptables-translate testsuite

helper

• nft_ct.
• Examples from iptables-translate testsuite

ipcomp

• nft_payload.
• Examples from iptables-translate testsuite

[Unsupported option : compres]

iprange

• nft_payload, through native range support. To emulate iptables --ports you need two rules.
• Examples from iptables-translate testsuite

ipvs

• consider native interface. Refer to Load balancing.

length

• nft_meta.
• Examples from iptables-translate testsuite

limit

• nft_limit. Refer to Stateful objects.
• Examples from iptables-translate testsuite

mac

• nft_payload.
• Examples from iptables-translate testsuite

mark

• nft_meta.
• Examples from iptables-translate testsuite

multiport

• nft_payload.
• Examples from iptables-translate testsuite

nfacct

• consider native interface. Refer to Stateful objects.

osf

• consider native interface

owner

• nft_meta.
• Examples from iptables-translate testsuite

[Unsupported option : socket-exists]

pkttype

• nft_meta
• Examples from iptables-translate testsuite

policy

• nft_xfrm, since 5.0
• Examples from iptables-translate testsuite

recent

• consider native interface. Refer to Sets.

sctp

• nft_payload
• nft_exthdr for --chunk-types
• Examples from iptables-translate testsuite

socket

• consider native interface

statistic

• nft_numgen. Refer to Load balancing.
• Examples from iptables-translate testsuite

set

• Use native nf_tables set infrastructure.

state

• nft_ct

tcp

• nft_payload
• Examples from iptables-translate testsuite

tcpmss

• nft_exthdr, since 4.14

time

• nft_meta, since 5.4
• Examples from iptables-translate testsuite

udp

• nft_payload
• Examples from iptables-translate testsuite

targets: xt

AUDIT

• nft_log, since 4.18.
• Examples from iptables-translate testsuite

CLASSIFY

• nft_meta, since 3.14.
• Examples from iptables-translate testsuite

CONNMARK

• nft_ct
• Examples from iptables-translate testsuite

CONNSECMARK

• nft_ct, since 4.20

DSCP

• nft_payload
• Examples from iptables-translate testsuite

HL

• nft_payload

HMARK

• nft_meta + nft_hash.

MARK

• nft_meta, since 3.14.
• Examples from iptables-translate testsuite

NETMAP

• nft_nat, upcoming 5.8

NFLOG

• nft_log, since 3.17.
• Examples from iptables-translate testsuite

NFQUEUE

• nft_queue, since 3.14.
• Examples from iptables-translate testsuite

SECMARK

• nft_meta, since 4.20

SYNPROXY

• nft_synproxy, since 5.3
• Examples from iptables-translate testsuite

TEE

• nft_dup, since 4.3.
• Examples from iptables-translate testsuite

TPROXY

• nft_tproxy, since 4.19

TRACE

• nft_meta, since 3.14.
• Examples from iptables-translate testsuite

TCPMSS

• nft_exthdr, since 4.14

matches: ipv4

ah

• nft_payload + nft_cmp
• Examples from iptables-translate testsuite

icmp

• nft_payload + nft_cmp.
• Examples from iptables-translate testsuite

[Unsupported codes: network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing ]

realm

• nft_meta, through NFT_META_RTCLASSID.
• Examples from iptables-translate testsuite

rp_filter

• nft_fib, starting with 4.10 kernel

ttl

• nft_payload
• Examples from iptables-translate testsuite

matches: ipv6

rp_filter

• nft_fib, starting with 4.10 kernel

ah

• nft_payload + nft_cmp.
• Examples from iptables-translate testsuite

eui64

• nft_payload + nft_cmp.

frag

• nft_exthdr + nft_cmp.
• Examples from iptables-translate testsuite

hbh

• nft_exthdr + nft_cmp.
• Examples from iptables-translate testsuite

HBH options are not supported yet. [Unsupported option: --hbh-opts]

hl

• nft_payload.
• Examples from iptables-translate testsuite

icmp6

• nft_payload + nft_cmp.
• Examples from iptables-translate testsuite

[Unsupported icmpv6 codes: no-route, communication-prohibited, beyond-scope, address-unreachable, port-unreachable, failed-policy, reject-route, ttl-zero-during-transit, ttl-zero-during-reassembly, bad-header, unknown-header-type and unknown-option]

ipv6header

• nft_exthdr + nft_cmp.

mh

• nft_exthdr + nft_cmp.
• Examples from iptables-translate testsuite

[Needs bug fixation for option mh-type with range]

rt

• nft_exthdr + nft_cmp
• Examples from iptables-translate testsuite

[Unsupported options: --rt-0-res, --rt-0-addrs, --rt-0-not-strict]

targets: ipv4

ECN

• nft_payload

DNAT

• nft_nat, since 3.13.
• Examples from iptables-translate testsuite

LOG

• nft_log, since 3.17.
• Examples from iptables-translate testsuite

[Unsupported options : log-tcp-sequence, log-tcp-options, log-ip-options, log-uid, log-macdecode]

MASQUERADE

• nft_masq, since 3.18.
• Examples from iptables-translate testsuite

REDIRECT

• nft_redirect, since 3.19.
• Examples from iptables-translate testsuite

REJECT

• nft_reject_ipv4, since 3.13.
• nft_reject_inet, since 3.14.
• nft_reject_bridge, since 3.18.
• Examples from iptables-translate testsuite

SNAT

• nft_nat, since 3.13.
• Examples from iptables-translate testsuite

targets: ipv6

DNAT

• nft_nat, since 3.13.
• Examples from iptables-translate testsuite

LOG

• nft_log, since 3.17.
• Examples from iptables-translate testsuite

[Unsupported options : log-tcp-sequence, log-tcp-options, log-ip-options, log-uid, log-macdecode]

MASQUERADE

• nft_masq, since 3.18.
• Examples from iptables-translate testsuite

REDIRECT

• nft_redirect, since 3.19.
• Examples from iptables-translate testsuite

REJECT

• nft_reject_ipv6, since 3.14.
• nft_reject_inet, since 3.14.
• nft_reject_bridge, since 3.18.
• Examples from iptables-translate testsuite

SNAT

• nft_nat, since 3.13.
• Examples from iptables-translate testsuite

matches: bridge

802.3

• nft_payload

among

• sets

arp

• nft_payload

ip

• nft_payload
• Examples from iptables-translate testsuite

ip6

• nft_payload
• Examples from iptables-translate testsuite

limit

• nft_limit
• Examples from iptables-translate testsuite

mark

• nft_mark
• Examples from iptables-translate testsuite

pkttype

• nft_meta
• Examples from iptables-translate testsuite

stp

• nft_payload

vlan

• nft_payload
• Examples from iptables-translate testsuite

targets: bridge

dnat

• nft_payload
• Examples from iptables-translate testsuite

snat

• nft_payload
• Examples from iptables-translate testsuite

redirect

• nft_payload + nft_meta (pkttype set unicast)

mark

• nft_mark
• Examples from iptables-translate testsuite

watchers: bridge

log

• nft_log
• Examples from iptables-translate testsuite

nflog

• nft_log
• Examples from iptables-translate testsuite

Deprecated extensions

matches

physdev

• br_netfilter aims to be deprecated by nftables.

quota

• nfacct already provides quota support.

tos

• deprecated by dscp

targets

CLUSTERIP

• deprecated by cluster match.

TOS

• deprecated by DSCP

targets: ipv4

ULOG

• Removed from tree since 3.17.