Why you will love nftables

When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables".

I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of.

Ahhh, well, I can wish, right?

Re: Why you will love nftables

#5

Post by lelf » Mon, Jan 20, 2014, 7:41 PM UTC

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

Sorry, NIH. And we won't see dtrace either

Re: Why you will love nftables

#6

Post by simcop2387 » Mon, Jan 20, 2014, 7:52 PM UTC

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

Re: Why you will love nftables

#7

Post by elehack » Mon, Jan 20, 2014, 7:54 PM UTC

simcop2387 wrote: post #6

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

I don't have good examples of what can or cannot be done.

But I find pf much easier to understand. I can write pf rules myself and understand, clearly, what my firewall is doing. I haven't found iptables near as approachable, and depend on firewall configuration tools to generate the rules and chains for me.

Re: Why you will love nftables

#8

Post by simcop2387 » Mon, Jan 20, 2014, 7:58 PM UTC

elehack wrote: post #7

simcop2387 wrote: post #6

Earlier quoted context omitted.

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

I don't have good examples of what can or cannot be done. But I find pf much easier to understand. I can write pf rules myself and understand, clearly, what my firewall is doing. I haven't found iptables near as approachable, and depend on firewall configuration tools to generate the rules and chains for me.

I'd definitely agree that iptables is not nearly as approachable as i've seen pf be. I've yet to see something that can't be done with it if you take the time (this is discounting performance, i know that it can get a little hairy after a few hundred rules if not setup correctly).

Re: Why you will love nftables

#9

Post by strcat » Mon, Jan 20, 2014, 8:11 PM UTC

lelf wrote: post #5

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

Sorry, NIH. And we won't see dtrace either

DTrace and ZFS are both available for Linux as out-of-tree kernel modules. Sun intentionally used a GPL-incompatible license... it has nothing to do with NIH.

Re: Why you will love nftables

#10

Post by xiljin » Mon, Jan 20, 2014, 8:22 PM UTC

simcop2387 wrote: post #6

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

Many people use something like denyhosts or fail2ban to help with brute force attacks. PF has built-in support for building rules with options which will throw potential attackers into a 'penalty box' based on certain factors like connection rate.