Difference between revisions of "What is nftables?"

From nftables wiki
Jump to: navigation, search
(initial page)
 
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
'''nftables''' is the new packet classification framework that intends to replace the existing {ip,ip6,arp,eb}_tables infrastructure. In a nutshell:
+
'''nftables''' is the new packet classification framework that <s>intends to</s> replaces the existing {ip,ip6,arp,eb}_tables infrastructure. In a nutshell:
  
 
* It is available in Linux kernels >= 3.13.
 
* It is available in Linux kernels >= 3.13.

Latest revision as of 04:05, 8 April 2017

nftables is the new packet classification framework that intends to replaces the existing {ip,ip6,arp,eb}_tables infrastructure. In a nutshell:

  • It is available in Linux kernels >= 3.13.
  • It comes with a new command line utility nft whose syntax is different to iptables.
  • It also comes with a compatibility layer that allows you to run iptables commands over the new nftables kernel framework.
  • It provides generic set infrastructure that allows you to construct maps and concatenation. You can use this new feature to arrange your ruleset in multidimensional tree which drastically reduces the number of rules that need to be inspected until you find the final action on the packet.