Difference between revisions of "Adoption"

From nftables wiki
Jump to navigation Jump to search
(add more examples)
(Edited page intro for clarity.)
 
(5 intermediate revisions by 3 users not shown)
Line 1: Line 1:
This page offers some light and data about current '''nftables adoption''' in the wider community.
The Netfilter project and community is focused on replacing the iptables framework with nftables, adding new features and refreshing some workflows along the way.
As you probably know, the focus of the Netfilter project and community is in replacing the iptables framework with nftables, adding brand new features and refreshing some workflows along the way.


Lots of upstream projects use iptables to handle NAT, filtering, mangling or other networking stuff.
Many upstream projects use iptables to handle filtering, NAT, mangling and other networking tasks. This page tracks '''nftables adoption''' in the wider community.
Here, the info we know about them, their relationship with nftables and the possibilities for them to migrate to nftables.


= Cases =
= Cases =


Known cases and examples we could heard of. '''TODO: extend with more current data'''.
Known cases and examples we could heard of. '''TODO: extend with more current data'''.
All major Linux distributions contains the nftables framework ready to use. Check [[Nftables from distributions]].


== system / firewalling / management ==
== system / firewalling / management ==


* http://www.fail2ban.org/ -- the fail2ban tool already includes native support for nftables.
=== Supporting nftables ===
* http://www.firewalld.org/ -- firewalld by RedHat is currently developing a native integration with nftables.
 
The following projects are known to either directly support nftables or have authors actively working on nftables integration.
 
* https://www.fail2ban.org/ -- the fail2ban tool already includes native support for nftables.
* https://firewalld.org/ -- firewalld by RedHat is currently developing a native integration with nftables.
* https://suricata-ids.org/ -- suricata can work natively with nftables ([https://home.regit.org/2014/02/suricata-and-nftables/ link])
* https://suricata-ids.org/ -- suricata can work natively with nftables ([https://home.regit.org/2014/02/suricata-and-nftables/ link])
* https://keepalived.org/ -- keepalived works natively with nftables ([https://github.com/acassen/keepalived/issues/924])
=== Supporting iptables only ===
The following projects are known to only support iptables/iptables-nft, with no plans to support nftables in the future.
* http://ferm.foo-projects.org/ -- [https://github.com/MaxKellermann/ferm/issues/35#issuecomment-386091563 citation]
* https://shorewall.org/ -- [https://sourceforge.net/p/shorewall/mailman/message/35458915/ citation]


== virtualization / cloud / infrastructure ==
== virtualization / cloud / infrastructure ==


* https://github.com/zevenet/nftlb -- nftlb by Zevenet is a nftables-based loadbalancer which can outperform LVS by 10x
* https://github.com/zevenet/nftlb -- nftlb by Zevenet is a nftables-based loadbalancer which can outperform LVS by 10x
* https://www.docker.com/ -- Some discussion happened in the Docker community regarding a native integration with nftables, which could ease some of their use cases ([https://github.com/moby/moby/issues/26824 link]) ([https://github.com/robbertkl/docker-ipv6nat/issues/17 link])
* https://www.docker.com/ -- Some discussion happened in the Docker community regarding a native integration with nftables, which could ease some of their use cases ([https://github.com/moby/moby/issues/26824 link]) ([https://github.com/robbertkl/docker-ipv6nat/issues/17 link]) ([https://stephank.nl/p/2017-06-05-ipv6-on-production-docker.html running docker with IPv6 using nftables])
* https://kubernetes.io/ -- Kubernetes does not support nftables yes, but some discussion happened already ([https://github.com/kubernetes/kubernetes/issues/45385 link]). Compat tools may be used to trick kubernetes into using nftables transparently.
* https://kubernetes.io/ -- Kubernetes does not support nftables yes, but some discussion happened already ([https://github.com/kubernetes/kubernetes/issues/45385 link]). Compat tools may be used to trick kubernetes into using nftables transparently.
* http://openstack.org/ -- Openstack does not support nftables yet. Compat tools may be used to trick neutron and other components into using nftables transparently.
* http://openstack.org/ -- Openstack does not support nftables yet. Compat tools may be used to trick neutron and other components into using nftables transparently.
Line 35: Line 47:
* VPN -- nftables can be combined with other software packages like OpenVPN to build great VPN solutions ([http://ral-arturo.org/2017/04/07/openvpn-debian-stretch.html link])
* VPN -- nftables can be combined with other software packages like OpenVPN to build great VPN solutions ([http://ral-arturo.org/2017/04/07/openvpn-debian-stretch.html link])
* [https://github.com/mdlayher/netlink netlink golang package] -- the Golang Netlink package got batching support to be able to work with nftables ([https://github.com/mdlayher/netlink/issues/81 link])
* [https://github.com/mdlayher/netlink netlink golang package] -- the Golang Netlink package got batching support to be able to work with nftables ([https://github.com/mdlayher/netlink/issues/81 link])
 
* [https://github.com/google/nftables nftables golang library] -- This nftables golang integration library was made by Google


= See also =
= See also =

Latest revision as of 19:07, 17 February 2021

The Netfilter project and community is focused on replacing the iptables framework with nftables, adding new features and refreshing some workflows along the way.

Many upstream projects use iptables to handle filtering, NAT, mangling and other networking tasks. This page tracks nftables adoption in the wider community.

Cases

Known cases and examples we could heard of. TODO: extend with more current data.

All major Linux distributions contains the nftables framework ready to use. Check Nftables from distributions.

system / firewalling / management

Supporting nftables

The following projects are known to either directly support nftables or have authors actively working on nftables integration.

Supporting iptables only

The following projects are known to only support iptables/iptables-nft, with no plans to support nftables in the future.

virtualization / cloud / infrastructure

others

See also