Nftables

(One intermediate revision by the same user not shown)

Line 1:

nftables are the Linux kernel's successor to [[iptables]] ~~and the~~ xtables ~~family~~. The primary tool used to interact with nftables is <tt>nft</tt>. The most important difference between the two is that nftables introduces a multidimensional tree and generic set infrastructure; the combination of IPv4 and IPv6 into the ''inet'' family is most welcome.

nftables are the Linux kernel's successor to [[iptables]], using xtables. The primary tool used to interact with nftables is <tt>nft</tt>. The most important difference between the two is that nftables introduces a multidimensional tree and generic set infrastructure; the combination of IPv4 and IPv6 into the ''inet'' family is most welcome.

The <tt>iptables</tt> tool can use an nftables backend. Typically the old iptables backend is available via a tool named e.g. <tt>iptables-legacy</tt>, while the new one can often be explicitly invoked using <tt>iptables-nft</tt>. Note, however, that even <tt>iptables-nft</tt> will not necessarily show all nftables, depending on how they were configured (for instance, using the <tt>IPMasquerade</tt> option of <tt>systemd-networkd</tt> with an nftables backend will not result in anything visible using <tt>iptables-nft -t nat -L</tt>). It's thus best to get in the habit of using <tt>nft list ruleset</tt>.

==<tt>nft</tt>==

<tt>nft</tt> is the nftables administration tool, replacing <tt>iptables</tt>.

==See also==

* "[https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables Moving from iptables to nftables]" from the nftables wiki

Nftables: Difference between revisions

Dank (talk | contribs)

@@ Line 1: / Line 1: @@
-nftables are the Linux kernel's successor to [[iptables]] and the xtables family. The primary tool used to interact with nftables is <tt>nft</tt>. The most important difference between the two is that nftables introduces a multidimensional tree and generic set infrastructure; the combination of IPv4 and IPv6 into the ''inet'' family is most welcome.
+nftables are the Linux kernel's successor to [[iptables]], using xtables. The primary tool used to interact with nftables is <tt>nft</tt>. The most important difference between the two is that nftables introduces a multidimensional tree and generic set infrastructure; the combination of IPv4 and IPv6 into the ''inet'' family is most welcome.
+The <tt>iptables</tt> tool can use an nftables backend. Typically the old iptables backend is available via a tool named e.g. <tt>iptables-legacy</tt>, while the new one can often be explicitly invoked using <tt>iptables-nft</tt>. Note, however, that even <tt>iptables-nft</tt> will not necessarily show all nftables, depending on how they were configured (for instance, using the <tt>IPMasquerade</tt> option of <tt>systemd-networkd</tt> with an nftables backend will not result in anything visible using <tt>iptables-nft -t nat -L</tt>). It's thus best to get in the habit of using <tt>nft list ruleset</tt>.
+==<tt>nft</tt>==
+<tt>nft</tt> is the nftables administration tool, replacing <tt>iptables</tt>.
 ==See also==
 * "[https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables Moving from iptables to nftables]" from the nftables wiki