Legacy xtables tools - Revision history

Fmyhr: /* In Linux distributions */ grammar

2021-02-12T11:33:10Z

In Linux distributions: grammar

← Older revision		Revision as of 11:33, 12 February 2021
Line 86:		Line 86:

	We recommend that, for a while, distros keep building and distributing both the legacy tools and the new nft-based as have been happening until now.		We recommend that, for a while, distros keep building and distributing both the legacy tools and the new nft-based as have been happening until now.
	Since the name of the binaries has ~~change~~, distros may need to provide a mechanism for users to freely switch back and forth from the legacy and the new tools.		Since the name of the binaries has changed, distros may need to provide a mechanism for users to freely switch back and forth from the legacy and the new tools.

	In Debian-based distros, for example, this is done by means of the ''update-alternatives'' mechanism.		In Debian-based distros, for example, this is done by means of the ''update-alternatives'' mechanism.

Arturo: /* How to know which tools I'm running */ delete -suffix in commands

2019-01-08T12:04:23Z

How to know which tools I'm running: delete -suffix in commands

← Older revision		Revision as of 12:04, 8 January 2019
Line 54:		Line 54:

	<pre>		<pre>
	user@machine:~$ sudo arptables~~-nft~~ --help		user@machine:~$ sudo arptables --help
	arptables v1.8.2		arptables v1.8.2

Line 64:		Line 64:

	<pre>		<pre>
	user@machine:~$ sudo ebtables~~-legacy~~ --help		user@machine:~$ sudo ebtables --help
	ebtables v2.0.10.4 (legacy) (December 2011)		ebtables v2.0.10.4 (legacy) (December 2011)
	Usage:		Usage:
Line 74:		Line 74:

	<pre>		<pre>
	user@machine:~$ sudo ebtables~~-nft~~ --help		user@machine:~$ sudo ebtables --help
	ebtables 1.8.2		ebtables 1.8.2
	Usage:		Usage:

Arturo: /* How to know which tools I'm running */ complete section with ebtables and arptables

2019-01-08T12:03:32Z

How to know which tools I'm running: complete section with ebtables and arptables

@@ Line 58: / Line 58: @@
 Usage: arptables -[AD] chain rule-specification [options]
 [...]
 </pre>

Arturo: /* How to know which tools I'm running */ add example of arptables-nft

2019-01-08T12:00:56Z

How to know which tools I'm running: add example of arptables-nft

← Older revision		Revision as of 12:00, 8 January 2019
Line 51:		Line 51:
	</pre>		</pre>

	~~'''TODO'''~~: ~~fillme~~		In arptables-nft, the version is the same as in iptables, included in the help output. Example:

			<pre>
			user@machine:~$ sudo arptables-nft --help
			arptables v1.8.2

			Usage: arptables -[AD] chain rule-specification [options]
			[...]
			</pre>

	== In Linux distributions ==		== In Linux distributions ==

Arturo: /* Naming */ remove /sbin prefix

2019-01-08T11:58:09Z

Naming: remove /sbin prefix

← Older revision		Revision as of 11:58, 8 January 2019
Line 8:		Line 8:
	This is a list of affected binaries:		This is a list of affected binaries:

	* ~~/sbin/~~iptables		* iptables
	* ~~/sbin/~~iptables-restore		* iptables-restore
	* ~~/sbin/~~iptables-save		* iptables-save
	* ~~/sbin/~~ip6tables		* ip6tables
	* ~~/sbin/~~ip6tables-restore		* ip6tables-restore
	* ~~/sbin/~~ip6tables-save		* ip6tables-save
	* ~~/sbin/~~arptables		* arptables
	* ~~/sbin/~~ebtables		* ebtables

	These tools are now installed with a '-legacy' string in the name:		These tools are now installed with a '-legacy' string in the name:

	* ~~/sbin/~~iptables-legacy		* iptables-legacy
	* ~~/sbin/~~iptables-legacy-restore		* iptables-legacy-restore
	* ~~/sbin/~~iptables-legacy-save		* iptables-legacy-save
	* ~~/sbin/~~ip6tables-legacy		* ip6tables-legacy
	* ~~/sbin/~~ip6tables-legacy-restore		* ip6tables-legacy-restore
	* ~~/sbin/~~ip6tables-legacy-save		* ip6tables-legacy-save
	* ~~/sbin/~~arptables-legacy		* arptables-legacy
	* ~~/sbin/~~ebtables-legacy		* ebtables-legacy

	The new tools contains now the '-nft' string in the name (formerly it was '-compat'):		The new tools contains now the '-nft' string in the name (formerly it was '-compat'):

	* ~~/sbin/~~xtables-nft-multi (this binary runs all the tools by means of symlinks)		* xtables-nft-multi (this binary runs all the tools by means of symlinks)
	* arptables-nft-save (new binary, not a direct equivalent in arptables-legacy)		* arptables-nft-save (new binary, not a direct equivalent in arptables-legacy)
	* arptables-nft-restore (new binary, not a direct equivalent in arptables-legacy)		* arptables-nft-restore (new binary, not a direct equivalent in arptables-legacy)

Arturo: /* Naming */ mention arptables and ebtables save/restore

2019-01-08T11:56:30Z

Naming: mention arptables and ebtables save/restore

← Older revision		Revision as of 11:56, 8 January 2019
Line 31:		Line 31:

	* /sbin/xtables-nft-multi (this binary runs all the tools by means of symlinks)		* /sbin/xtables-nft-multi (this binary runs all the tools by means of symlinks)
			* arptables-nft-save (new binary, not a direct equivalent in arptables-legacy)
			* arptables-nft-restore (new binary, not a direct equivalent in arptables-legacy)
			* ebtables-nft-save (new binary, not a direct equivalent in ebtables-legacy)
			* ebtables-nft-restore (new binary, not a direct equivalent in ebtables-legacy)

	== How to know which tools I'm running ==		== How to know which tools I'm running ==

Arturo: Create page with basic content

2018-06-20T14:10:28Z

Create page with basic content

New page

This page offers information on the status of the '''legacy xtables tools'''.

All the xtables/setsockopt based tools are all now considered legacy. New, modern tools exist based on the nf_tables kernel backend.
This was decided in the annual Netfilter Workshop held in 2018 in Berlin ([http://ral-arturo.org/2018/06/16/nfws2018.html link to a summary]).

== Naming ==

This is a list of affected binaries:

* /sbin/iptables
* /sbin/iptables-restore
* /sbin/iptables-save
* /sbin/ip6tables
* /sbin/ip6tables-restore
* /sbin/ip6tables-save
* /sbin/arptables
* /sbin/ebtables

These tools are now installed with a '-legacy' string in the name:

* /sbin/iptables-legacy
* /sbin/iptables-legacy-restore
* /sbin/iptables-legacy-save
* /sbin/ip6tables-legacy
* /sbin/ip6tables-legacy-restore
* /sbin/ip6tables-legacy-save
* /sbin/arptables-legacy
* /sbin/ebtables-legacy

The new tools contains now the '-nft' string in the name (formerly it was '-compat'):

* /sbin/xtables-nft-multi (this binary runs all the tools by means of symlinks)

== How to know which tools I'm running ==

In arptables-legacy, the string '''(legacy)''' has been included in the help output. Example:

<pre>
user@machine:~$ sudo arptables --help
arptables v0.0.4 (legacy)

Usage: arptables -[AD] chain rule-specification [options]
arptables -[RI] chain rulenum rule-specification [options]
arptables -D chain rulenum [options]
arptables -[LFZ] [chain] [options]
[...]
</pre>

'''TODO''': fillme

== In Linux distributions ==

Your Linux distribution/vendor must inform you in which capacity they are including legacy/nft tools.

We recommend that, for a while, distros keep building and distributing both the legacy tools and the new nft-based as have been happening until now.
Since the name of the binaries has change, distros may need to provide a mechanism for users to freely switch back and forth from the legacy and the new tools.

In Debian-based distros, for example, this is done by means of the ''update-alternatives'' mechanism.

== Where to find each tool ==

Please refer to your Linux distribution on vendor for specific details.
You should probably be using a packaged version of these tools.

The source code repositories are:

* (new tools) http://git.netfilter.org/iptables/ (same repo of the old legacy tools, it includes new arptables and ebtables)
* (iptables-legacy) http://git.netfilter.org/iptables/ (same repo of the new, nf_tables-based, tools)
* (arptables-legacy) http://git.netfilter.org/ebtables/
* (ebtables-legacy) http://git.netfilter.org/arptables/

== See also ==

* [[Moving from iptables to nftables]]
* [[Moving from ipset to nftables]]