View source for Supported features compared to xtables

Last update: Aug/2018
                                                                                 
This page tracks the list of supported and unsupported extensions with comments and suggestions.
                                                                                 
== Unsupported extensions ==                                                     
                                                                                 
=== matches: xt ===                                                              
                                                                                 
==== bpf ====                                                                    
* consider native interface                                                      
==== cluster ====                                                                
* consider native interface                                                      
==== rateest ====                                                                
* consider native interface                                                      
==== string ====                                                                 
* consider native interface                                                      
==== u32 ====                                                                    
* raw expressions?                                                               

=== targets: xt ===                                                              
                                                         
==== CHECKSUM ====                                                               
* add nft_payload.
* To the day, the only use case for this was DHCP clients not working with partial checksums. That should be fixed nowadays.
* See https://lwn.net/Articles/396466/ and https://www.spinics.net/lists/kvm/msg37660.html
* See https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/930962 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832090

==== CT ====                                                                     
* nft_ct_target. Refer to [[Matching_connection_tracking_stateful_metainformation]].                                              
==== IDLETIMER ====                                                              
* consider native interface
==== LED ====                                                                    
* consider native (need this?)                                                                                                            
==== RATEEST ====                                                                
* consider native interface                                                      
==== TCPOPTSTRIP ====                                                            
* consider native interface, need to extend nft_exthdr.c

=== targets: ipv4 ===                                                            
                                                                                 
==== TTL ====
                                                                                 
=== targets: ipv6 ===                                                            
                                                                                 
==== NPT ====                                                                    
* consider native interface

=== targets: bridge ===

==== arpreply ====
* consider native interface

=== watchers: bridge ===

==== log ====
* nft_log

==== nflog ====
* nft_log

=== targets: arp ===

TODO

== Supported extensions ==                                                       
                                                                                 
=== matches: xt ===                                                              

==== addrtype ====
* nft_fib, starting with 4.10 kernel. Refer to [[Matching routing information]].

==== cgroup ====
* nft_meta. Refer to [[Quick_reference-nftables_in_10_minutes#Meta]].
[Awaits support for cgroup2]                                                                             
==== comment ====
* Built-in support via NFTA_RULE_USERDATA, since 3.15 (Pablo Neira). Refer to [[Matching_packet_headers#Matching_UDP.2FTCP_headers_in_the_same_rule|matching UDP/TCP headers in the same rule]].

==== connbytes ====                                                              
* nft_ct, 4.5 kernel. Refer to [[Meters]].
==== connlabel ====                                                              
* nft_meta, since 3.16.
==== connlimit ====
* consider native interface. Refer to [[Meters]].
==== connmark ====
* nft_meta.
==== conntrack ====
* nft_ct.
==== cpu ====
* nft_meta, since 3.18.
==== dccp ====                                                                   
* nft_payload.    
[Unsupported option : dccp-option]
==== devgroup ====                                                               
* nft_meta, since 3.18.  
==== dscp ====                                              
* nft_payload.
==== ecn ====                                                                    
* nft_payload.                                                                   
==== esp ====                                                                    
* nft_payload.                                                                   
==== hashlimit ====                                                              
* meter statement. Refer to [[Meters]].
==== helper ====                                                                 
* nft_ct.
==== ipcomp ====
* nft_payload.
[Unsupported option : compres]
==== iprange ====                                                                
* nft_payload, through native range support. To emulate iptables --ports you need two rules.                                                   
==== ipvs ====
* consider native interface. Refer to [[Load balancing]].
==== length ====                                                                 
* nft_meta.                                                                      
==== limit ====                                                                  
* nft_limit. Refer to [[Stateful objects]].
==== mac ====                                                                    
* nft_payload.                                                                   
==== mark ====                                                                   
* nft_meta.                                                                      
==== multiport ====                                                              
* nft_payload. 
[Unsupported option : ports]                                                                                         
==== nfacct ====
* consider native interface. Refer to [[Stateful objects]].
==== osf ====
* consider native interface
==== owner ====                                                                  
* nft_meta. 
[Unsupported option : socket-exists]                                                                     
==== pkttype ====                                                                
* nft_meta
==== policy ====
* nft_xfrm, since 5.0
==== recent ====                                                                 
* consider native interface. Refer to [[Sets]].
==== sctp ====                                                                   
* nft_payload
* nft_exthdr for --chunk-types
==== socket ====
* consider native interface
==== statistic ====
* nft_numgen. Refer to [[Load balancing]].
==== set ====
* Use native nf_tables set infrastructure.                                       
==== state ====                                                                  
* nft_ct                                                                         
==== tcp ====
* nft_payload
==== tcpmss ====                                                                 
* nft_exthdr, since 4.14

==== time ====
* nft_meta, since 5.4

==== udp ====                                                                 
* nft_payload

=== targets: xt ===                                                              

==== AUDIT ====                                                              
* nft_log, since 4.18.
==== CLASSIFY ====                                                               
* nft_meta, since 3.14.    
==== CONNMARK ====                                                                                                                    
* nft_ct
==== CONNSECMARK ====
* nft_ct, since 4.20
==== DSCP ====                                                                                                                    
==== HL ====
* nft_payload
==== HMARK ====
* nft_meta + nft_hash.
==== MARK ====                                                                   
* nft_meta, since 3.14.
==== NETMAP ====                                                                 
* nft_nat, upcoming 5.8              
==== NFLOG ====                                                                  
* nft_log, since 3.17.                                             
==== NFQUEUE ====                                                                
* nft_queue, since 3.14.
==== SECMARK ====
* nft_meta, since 4.20

==== SYNPROXY ====
* nft_synproxy, since 5.3

==== TEE ====
* nft_dup, since 4.3.
==== TPROXY ====
* nft_tproxy, since 4.19

==== TRACE ====                                                                  
* nft_meta, since 3.14.

==== TCPMSS ====                                                                 
* nft_exthdr, since 4.14

=== matches: ipv4 ===                                                            
                                                                                 
==== ah ====                                                                     
* nft_payload + nft_cmp
==== icmp ====
* nft_payload + nft_cmp.
[Unsupported codes: network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing ]
==== realm ====                                                                  
* nft_meta, through NFT_META_RTCLASSID. 
==== rp_filter ====
* nft_fib, starting with 4.10 kernel
==== ttl ====

=== matches: ipv6 ===                                                            
            
==== rp_filter ====
* nft_fib, starting with 4.10 kernel                                                                    
==== ah  ====                                                                    
* nft_payload + nft_cmp.
==== eui64 ====
* nft_payload + nft_cmp.
==== frag ====
* nft_exthdr + nft_cmp.
==== hbh ====
* nft_exthdr + nft_cmp.
HBH options are not supported yet.
[Unsupported option: --hbh-opts]
==== hl ==== 
* nft_payload.    
==== icmp6 ====
* nft_payload + nft_cmp.
[Unsupported icmpv6 codes: no-route, communication-prohibited, beyond-scope, address-unreachable, port-unreachable, failed-policy, reject-route, ttl-zero-during-transit, ttl-zero-during-reassembly, bad-header, unknown-header-type and unknown-option]
==== ipv6header ====
* nft_exthdr + nft_cmp.
==== mh ====
* nft_exthdr + nft_cmp.
[Needs bug fixation for option mh-type with range]
==== rt ====
* nft_exthdr + nft_cmp
[Unsupported options: --rt-0-res, --rt-0-addrs, --rt-0-not-strict]

=== targets: ipv4 ===
==== ECN ====                                                                    
* nft_payload

==== DNAT ====    
* nft_nat, since 3.13.    
==== LOG ====                                                                    
* nft_log, since 3.17.  
[Unsupported options : log-tcp-sequence, log-tcp-options, log-ip-options, log-uid, log-macdecode]
==== MASQUERADE ====
* nft_masq, since 3.18.
==== REDIRECT ====
* nft_redirect, since 3.19.

==== REJECT ====                                                                 
* nft_reject_ipv4, since 3.13.                                         
* nft_reject_inet, since 3.14.
* nft_reject_bridge, since 3.18.  
==== SNAT ====                                                            
* nft_nat, since 3.13.

=== targets: ipv6 ===
==== DNAT ====
* nft_nat, since 3.13.    
==== LOG ====
* nft_log, since 3.17.  
[Unsupported options : log-tcp-sequence, log-tcp-options, log-ip-options, log-uid, log-macdecode]
==== MASQUERADE ====                                                             
* nft_masq, since 3.18.
==== REDIRECT ====                                                               
* nft_redirect, since 3.19.

==== REJECT ====                                                                                   
* nft_reject_ipv6, since 3.14.                     
* nft_reject_inet, since 3.14.
* nft_reject_bridge, since 3.18.    
==== SNAT ====                                                                                                                          
* nft_nat, since 3.13.

=== matches: bridge ===

==== 802.3 ====
* nft_payload

==== among ====
* sets

==== arp ====
* nft_payload

==== ip ====
* nft_payload

==== ip6 ====
* nft_payload

==== limit ====
* nft_limit

==== mark ====
* nft_mark

==== pkttype ====
* nft_meta

==== stp ====
* nft_payload

==== vlan ====
* nft_payload


=== targets: bridge ===

==== dnat ====
* nft_payload

==== snat ====
* nft_payload

==== redirect ====
* nft_payload + nft_meta (pkttype set unicast)

==== mark ====
* nft_mark

== Deprecated extensions ==                                                      
                                                                                 
=== matches ===                                                                  
 
==== physdev ====                                                                
* br_netfilter aims to be deprecated by nftables.                                                                                
==== quota ====                                                                  
* nfacct already provides quota support.  
==== tos ====
* deprecated by dscp                                       
                                                                                 
=== targets ===                                                                  
                                                                                 
==== CLUSTERIP ====                                                              
* deprecated by cluster match.                                                   
==== TOS ====                                                                 
* deprecated by DSCP

=== targets: ipv4 ===                                                            
                                                                                 
==== ULOG ====                                                                   
* Removed from tree since 3.17.