Moving from iptables to nftables - Revision history

Fmyhr: dictionaries -> verdict maps

2021-02-12T10:53:21Z

dictionaries -> verdict maps

← Older revision		Revision as of 10:53, 12 February 2021
Line 8:		Line 8:
	* [[List of available translations via iptables-translate tool]]		* [[List of available translations via iptables-translate tool]]

	After the migration process, you are encouraged to implement new nftables mechanisms such as sets, maps, ~~dictionaries~~, concatenations and more.		After the migration process, you are encouraged to implement new nftables mechanisms such as sets, maps, [[Verdict_Maps_(vmaps) \| verdict maps]], concatenations and more.

	== command translation ==		== command translation ==

Arturo: /* using the nf_tables compat backend */ typo hare

2019-07-30T14:56:53Z

using the nf_tables compat backend: typo hare

← Older revision		Revision as of 14:56, 30 July 2019
Line 74:		Line 74:
	== using the nf_tables compat backend ==		== using the nf_tables compat backend ==

	Since June 2018, the old xtables/setsockopt tools ~~hare~~ considered legacy.		Since June 2018, the old xtables/setsockopt tools are considered legacy.

	However, there is support to use the iptables/ip6tables/arptables/ebtables old syntax with the nf_tables kernel backend.		However, there is support to use the iptables/ip6tables/arptables/ebtables old syntax with the nf_tables kernel backend.

Arturo: Refresh page with new legacy renaming

2018-06-20T14:27:19Z

Refresh page with new legacy renaming

← Older revision		Revision as of 14:27, 20 June 2018
Line 1:		Line 1:
			This page gives information on '''moving/migrating''' from the old iptables/xtables (legacy) world to the new nftables framework.

	A common situation is the need to move from an existing iptables ruleset to nftables.		A common situation is the need to move from an existing iptables ruleset to nftables.
	The Netfilter team has created some tools and mechanisms to ease in this move.		The Netfilter team has created some tools and mechanisms to ease in this move.
Line 72:		Line 74:
	== using the nf_tables compat backend ==		== using the nf_tables compat backend ==

	~~There~~ is support to use the iptables/ip6tables/arptables/ebtables old syntax with the nf_tables kernel backend.		Since June 2018, the old xtables/setsockopt tools hare considered legacy.
	~~You will need~~ the *-compat tools:
			However, there is support to use the iptables/ip6tables/arptables/ebtables old syntax with the nf_tables kernel backend.

			This is described with further details in the [[Legacy xtables tools]] wiki page.

	<source>		<source>
	% iptables-~~compat~~ -A FORWARD -p icmp -j ACCEPT		% iptables-nft -A FORWARD -p icmp -j ACCEPT

	% iptables-~~compat~~-save		% iptables-nft-save
	# Generated by xtables-save v1.6.0 on Sat Dec 24 14:38:08 2016		# Generated by xtables-save v1.6.0 (nf_tables) on Sat Dec 24 14:38:08 2016
	*filter		*filter
	:INPUT ACCEPT [62:3777]		:INPUT ACCEPT [62:3777]
Line 110:		Line 115:

	<source>		<source>
	% ebtables-~~compat~~ -L		% ebtables-nft -L
	Bridge table: filter		Bridge table: filter

Line 139:		Line 144:
	</source>		</source>

	With these tools, the workflow could be saving the old iptables ruleset and then loading it with iptables-~~compat~~:		With these tools, the workflow could be saving the old iptables-legacy ruleset and then loading it with iptables-nft:

	<source>		<source>
	% iptables-save > iptables.txt		% iptables-save > iptables.txt
	% iptables-~~compat~~-restore < iptables.txt		% iptables-nft-restore < iptables.txt

	% iptables-~~compat~~-save		% iptables-nft-save
	# Generated by xtables-save v1.6.0 on Sat Dec 24 14:51:41 2016		# Generated by xtables-save v1.6.0 (nf_tables) on Sat Dec 24 14:51:41 2016
	*filter		*filter
	:INPUT ACCEPT [19:1283]		:INPUT ACCEPT [19:1283]
Line 172:		Line 177:
	</source>		</source>

	Beware of using both the ~~compat~~ and the ~~standard tool~~ at the same time. That means using both x_tables and nf_tables kernel subsystems at the same time, and could lead to unexpected results.		Beware of using both the nft and the legacy tools at the same time. That means using both x_tables and nf_tables kernel subsystems at the same time, and could lead to unexpected results.

	== See also ==		== See also ==

Arturo: /* See also */ add link to legacy tools page

2018-06-20T14:11:05Z

Arushi at 15:29, 14 June 2018

2018-06-14T15:29:48Z

← Older revision		Revision as of 15:29, 14 June 2018
Line 24:		Line 24:
	<source>		<source>
	% iptables-save > save.txt		% iptables-save > save.txt
	% cat save		% cat save.txt
	# Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016		# Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
	*filter		*filter

Arturo: add see also section

2018-02-01T10:17:10Z

add see also section

← Older revision		Revision as of 10:17, 1 February 2018
Line 173:		Line 173:

	Beware of using both the compat and the standard tool at the same time. That means using both x_tables and nf_tables kernel subsystems at the same time, and could lead to unexpected results.		Beware of using both the compat and the standard tool at the same time. That means using both x_tables and nf_tables kernel subsystems at the same time, and could lead to unexpected results.

			== See also ==

			* [[Moving from ipset to nftables]]

Arturo: create page with basic content

2016-12-24T13:55:45Z

create page with basic content

New page

A common situation is the need to move from an existing iptables ruleset to nftables.
The Netfilter team has created some tools and mechanisms to ease in this move.

Please, make sure to check the links below:
* [[Supported features compared to xtables]]
* [[List of available translations via iptables-translate tool]]

After the migration process, you are encouraged to implement new nftables mechanisms such as sets, maps, dictionaries, concatenations and more.

== command translation ==

You can generate a translation of an iptables/ip6tables command to know the nftables equivalent.

<source>
% iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
nft add rule ip filter INPUT tcp dport 22 ct state new counter accept

% ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept
</source>

Instead of translating command by command, you can translate your whole ruleset in a single run:

<source>
% iptables-save > save.txt
% cat save
# Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
*filter
:INPUT ACCEPT [5166:1752111]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5058:628693]
-A FORWARD -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Dec 24 14:26:40 2016
</source>

<source>
% iptables-restore-translate -f save.txt
# Translated by iptables-restore-translate v1.6.0 on Sat Dec 24 14:26:59 2016
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; }
add chain ip filter FORWARD { type filter hook forward priority 0; }
add chain ip filter OUTPUT { type filter hook output priority 0; }
add rule ip filter FORWARD tcp dport 22 ct state new counter accept
</source>

You should be able to directly give this to nftables:

<source>
% iptables-restore-translate -f save.txt > ruleset.nft
% nft -f ruleset.nft

% nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority 0; policy accept;
}

chain FORWARD {
type filter hook forward priority 0; policy accept;
tcp dport ssh ct state new counter packets 0 bytes 0 accept
}

chain OUTPUT {
type filter hook output priority 0; policy accept;
}
}
</source>

These translate tools are included in the iptables source tarball and works for iptables and ip6tables.

== using the nf_tables compat backend ==

There is support to use the iptables/ip6tables/arptables/ebtables old syntax with the nf_tables kernel backend.
You will need the *-compat tools:

<source>
% iptables-compat -A FORWARD -p icmp -j ACCEPT

% iptables-compat-save
# Generated by xtables-save v1.6.0 on Sat Dec 24 14:38:08 2016
*filter
:INPUT ACCEPT [62:3777]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [62:4074]
-A FORWARD -p icmp -j ACCEPT
COMMIT
# Completed on Sat Dec 24 14:38:08 2016

% nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority 0; policy accept;
}

chain FORWARD {
type filter hook forward priority 0; policy accept;
ip protocol icmp counter packets 0 bytes 0 accept
}

chain OUTPUT {
type filter hook output priority 0; policy accept;
}
}
</source>

Note that translation to native nftables syntax is done if available.

In the case of some missing translation, you will see a commented rule in nftables:

<source>
% ebtables-compat -L
Bridge table: filter

Bridge chain: INPUT, entries: 0, policy: ACCEPT

Bridge chain: FORWARD, entries: 2, policy: ACCEPT
--802_3-type 0x0001 -j CONTINUE
--mark 0x1 -j CONTINUE

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

% nft list ruleset
table bridge filter {
chain INPUT {
type filter hook input priority -200; policy accept;
}

chain FORWARD {
type filter hook forward priority -200; policy accept;
#--802_3-type 0x0001 counter packets 0 bytes 0
#--mark 0x1 counter packets 0 bytes 0
}

chain OUTPUT {
type filter hook output priority -200; policy accept;
}
}
</source>

With these tools, the workflow could be saving the old iptables ruleset and then loading it with iptables-compat:

<source>
% iptables-save > iptables.txt
% iptables-compat-restore < iptables.txt

% iptables-compat-save
# Generated by xtables-save v1.6.0 on Sat Dec 24 14:51:41 2016
*filter
:INPUT ACCEPT [19:1283]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [18:2487]
-A FORWARD -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Dec 24 14:51:41 2016

% nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority 0; policy accept;
}

chain FORWARD {
type filter hook forward priority 0; policy accept;
ip protocol tcp tcp dport 22 ct state new counter packets 0 bytes 0 accept
}

chain OUTPUT {
type filter hook output priority 0; policy accept;
}
}
</source>

Beware of using both the compat and the standard tool at the same time. That means using both x_tables and nf_tables kernel subsystems at the same time, and could lead to unexpected results.

← Older revision		Revision as of 14:11, 20 June 2018
Line 177:		Line 177:

	* [[Moving from ipset to nftables]]		* [[Moving from ipset to nftables]]
			* [[Legacy xtables tools]]