from Hacker News

New in Debian stable Stretch: nftables

by marksamman on 5/7/17, 3:49 PM with 59 comments

  • by arca_vorago on 5/7/17, 5:17 PM

    Quite a few advantages to nftables. I have been advocating for people to start learning it now instead of later. One of the primary issues I have seen in systems from a sysadmin perspective is poorly configured iptables. I disagree with all the abstractions that make it "easier" but result in more misconfigs. Besides improvements I expect to filter back over to linux from the dragonfly bsd netstack, nftables is one of the biggest moves in a while. Next up, routing engines like Cjdns, but that's a different discussion.

    From the nftables wikipedia:

    "...iptables firewalling code, which has protocol awareness built-in so deeply into the logic that the code has had to be replicated four times—for IPv4, IPv6, ARP, and Ethernet bridging—as the firewall engines are too protocol-specific to be used in a generic manner.[10]

    The main advantages of nftables over iptables are the simplification of the Linux kernel ABI, reduction of code duplication, improved error reporting, and more efficient execution, storage and incremental changes of filtering rules. Traditionally used iptables(8), ip6tables(8), arptables(8) and ebtables(8) (for IPv4, IPv6, ARP and Ethernet bridging, respectively) are intended to be replaced with nft(8) as a single unified implementation, providing firewall configuration on top of the in-kernel virtual machine.

    nftables also offers an improved userspace API that allows atomic replacements of one or more firewall rules within a single Netlink transaction. That speeds up firewall configuration changes for setups having large rulesets; it can also help in avoiding race conditions while the rule changes are being executed. Also, a planned compatibility layer is going to provide translation of already existing iptables firewall rules into their nftables equivalents."

  • by smartbit on 5/7/17, 7:05 PM

    Pablo Neira Ayuso, maintainer of nftables, in May 2016 gave a presentation Goodbye iptables, Hello nftables [0] and a handson Workshop [1] at the nluug.nl spring conference.

    [0] webm http://ftp.nluug.nl/video/nluug/2016-05-26_vj16/Zaal2/21%20-... or https://www.youtube.com/watch?v=0wQfSfDVN94

    [1] webm http://ftp.nluug.nl/video/nluug/2016-05-26_vj16/Zaal3/3%20-%... or https://www.youtube.com/watch?v=FXTRRwXi3b4

  • by ktta on 5/7/17, 6:09 PM

    A good answer to the question "why move to nftables?"

    https://developers.redhat.com/blog/2016/10/28/what-comes-aft...

  • by dspillett on 5/8/17, 12:06 AM

    It is worth noting that "Stretch" (Debian Release 9.x) is not yet released as "stable" and as such is not currently recommended for production use. It is currently Debian Testing, not Debian Stable, with "Jessie" (release 8.x) carrying the "Stable" moniker.

    IIRC that is due to change imminently, as Stretch entered full feature freeze in February in preparation for release, and I've not heard of any massive show-stoppers since, but if you install "stable" right now you'll get Jessie (release 8.x) not Stretch (r9).

  • by warbiscuit on 5/7/17, 7:36 PM

    Does anyone know if [Shorewall](http://shorewall.org/) has plans to support nftables, or is it staying on iptables for now?

    While I'm excited to hear about a simplified abstraction at the kernel level, for most setups I've had to configure, I really like the highlevel abstraction it provides.

  • by tmaly on 5/7/17, 8:24 PM

    Will we still get the choice to use iptables instead of nftables? I do all the sysadmin stuff for my own servers, and I prefer stability on the tool front.

    I am not yet ready to learn a new tool, and this new tool does not have all the features as the old tool according to others commenting.

  • by chrisper on 5/7/17, 5:11 PM

    I still prefer Vyetta's interface. It can be used in VyOS(https://vyos.io).

    If you have to use it on a regular Linux box, I prefer UFW.

    Though, it looks like nftables has finally a nicer syntax than iptables making wrappers like UFW unecessary.

  • by kpcyrd on 5/7/17, 8:40 PM

    I got excited for a moment, but debian stretch is not released as stable yet? https://www.debian.org/releases/

  • by ptman on 5/8/17, 10:47 AM

    IIUC nft tools also provide a way to write the rules in a file and atomically replace the current ruleset with an updated one. To do this with iptables, I've had to use ferm http://ferm.foo-projects.org/ , which, even if it is a nice tool, is a bit of a badaid on top of iptables. I've always liked pf.conf & pfctl, and nft tools seem to be a step in that direction.

  • by ilaksh on 5/7/17, 8:42 PM

    Sounds better implementation wise but what about the interface for sys admins? It seems the syntax is complex enough that you need to copy a file to start.

    Can ufw use nftables as a back end? And/or is there a good clean and easy to understand explanation for how to use nftables and useful reference?

    Is there a tool to help with common configuration tasks?

  • by SpiegS on 5/7/17, 4:40 PM

    Still, nothing beats OpenBSD's pf

  • by rfraile on 5/8/17, 8:30 AM

  • by nwmcsween on 5/7/17, 10:28 PM

    I still don't understand why $firewall isn't simply a psuedo fs like /proc and control is simply managing trees or chains using basic command line tools.

  • by joosters on 5/7/17, 5:20 PM

    This page is terribly written, it gives almost no information about why nftables is better than iptables. What features does it have? What can it do that iptables can't? The page can't be bothered to tell us.

    Instead, all we get is a vague 'the system is more configurable than in iptables' and 'the syntax is much better than in iptables' (like what good is that to someone who already has iptables set up? The last thing people want to do is mess with firewall rules on a working system)

    Yes, I know that Debian is FOSS and I can help improve it, but why introduce a whole new firewall system where the 'Moving from iptables to nftables' docs are pages and pages of shell commands? Wouldn't some kind of automated update, to help common use cases, be a sensible thing to include in such an update? (Maybe such a thing exists, but the page doesn't bother to tell me about any such thing).

    Instead of going on about how to set up nftables from scratch, perhaps they should focus a little more on 'I have a system using your older recommended firewall, what do I need to do to keep things working?'