The beginning of the end of iptables: Difference between revisions

Line 1:

'''[[Dankblog|dankblog!]] 2024-04-19, 2334 EST, at [[Viewpoint|the danktower]]'''

when i was but a wee lad, Linux was circling around a sensible packet filtering infrastructure. there had been the generally unacceptable <tt>ipfwadm</tt> in 2.0, pretty clearly behind OpenBSD's PF (later brought into FreeBSD 5.2) and FreeBSD's IPFW. Rusty Russell (whom we haven't heard much from recently--I wonder where he's gone) implemented the stateless <tt>ipchains</tt> in 2.2, and then replaced it in 2.4 with [[iptables]], a full-featured solution that stood for a decade. i memorized the entirety of iptables early on, and it served me very well in my career. indeed, even in 2022 i was employing obscure iptables functionality in conjunction with eBPF to implement advanced, novel ~~functionality~~ (the "Illithid" traffic shaper at Microsoft).

when i was but a wee lad, Linux was circling around a sensible packet filtering infrastructure. there had been the generally unacceptable <tt>ipfwadm</tt> in 2.0, pretty clearly behind OpenBSD's PF (later brought into FreeBSD 5.2) and FreeBSD's IPFW. Rusty Russell (whom we haven't heard much from recently--I wonder where he's gone) implemented the stateless <tt>ipchains</tt> in 2.2, and then replaced it in 2.4 with [[iptables]], a full-featured solution that stood for a decade. i memorized the entirety of iptables early on, and it served me very well in my career. indeed, even in 2022 i was employing obscure iptables functionality in conjunction with eBPF to implement advanced, novel warez (the "Illithid" traffic shaper at Microsoft).

kernel 3.13 introduced "nftables", controlled by the <tt>nft</tt> userspace binary. nftables unifies the packet filtering space, previously split among iptables, ip6tables, ebtables (for bridging), and arptables, combining the existing Netfilter netstack hooks with a virtual machine. nftables supported a compatibility layer for the vast majority (by popularity) of iptables functionality: for at least the past five years, if you've been using <tt>iptables</tt>, you've most likely been using <tt>iptables-nft</tt>, and actually creating nftables rulesets (<tt>iptables-legacy</tt> has continued to use the legacy kernel infrastructure). there are four sets of <tt>-nft</tt> and <tt>-legacy</tt> for the four elements of the space.

@@ Line 1: / Line 1: @@
 '''[[Dankblog|dankblog!]] 2024-04-19, 2334 EST, at [[Viewpoint|the danktower]]'''
-when i was but a wee lad, Linux was circling around a sensible packet filtering infrastructure. there had been the generally unacceptable <tt>ipfwadm</tt> in 2.0, pretty clearly behind OpenBSD's PF (later brought into FreeBSD 5.2) and FreeBSD's IPFW. Rusty Russell (whom we haven't heard much from recently--I wonder where he's gone) implemented the stateless <tt>ipchains</tt> in 2.2, and then replaced it in 2.4 with [[iptables]], a full-featured solution that stood for a decade. i memorized the entirety of iptables early on, and it served me very well in my career. indeed, even in 2022 i was employing obscure iptables functionality in conjunction with eBPF to implement advanced, novel functionality (the "Illithid" traffic shaper at Microsoft).
+when i was but a wee lad, Linux was circling around a sensible packet filtering infrastructure. there had been the generally unacceptable <tt>ipfwadm</tt> in 2.0, pretty clearly behind OpenBSD's PF (later brought into FreeBSD 5.2) and FreeBSD's IPFW. Rusty Russell (whom we haven't heard much from recently--I wonder where he's gone) implemented the stateless <tt>ipchains</tt> in 2.2, and then replaced it in 2.4 with [[iptables]], a full-featured solution that stood for a decade. i memorized the entirety of iptables early on, and it served me very well in my career. indeed, even in 2022 i was employing obscure iptables functionality in conjunction with eBPF to implement advanced, novel warez (the "Illithid" traffic shaper at Microsoft).
 kernel 3.13 introduced "nftables", controlled by the <tt>nft</tt> userspace binary. nftables unifies the packet filtering space, previously split among iptables, ip6tables, ebtables (for bridging), and arptables, combining the existing Netfilter netstack hooks with a virtual machine. nftables supported a compatibility layer for the vast majority (by popularity) of iptables functionality: for at least the past five years, if you've been using <tt>iptables</tt>, you've most likely been using <tt>iptables-nft</tt>, and actually creating nftables rulesets (<tt>iptables-legacy</tt> has continued to use the legacy kernel infrastructure). there are four sets of <tt>-nft</tt> and <tt>-legacy</tt> for the four elements of the space.

The beginning of the end of iptables: Difference between revisions

Dank (talk | contribs)