Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why you will love nftables

home.regit.org

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Why you will love nftables

#11

Post by simcop2387 »

xiljin wrote: post #10
simcop2387 wrote: post #6

Earlier quoted context omitted.

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

Many people use something like denyhosts or fail2ban to help with brute force attacks. PF has built-in support for building rules with options which will throw potential attackers into a 'penalty box' based on certain factors like connection rate.

That one I haven't seen before, I wonder if the new nftables might be able to implement any of that. Based on the state machine specs probably not, since I don't think there's any storage or any way for it to generate new rules on itself based on what I've read.

Re: Why you will love nftables

#12

Post by hebz0rl »

xiljin wrote: post #10
simcop2387 wrote: post #6

Earlier quoted context omitted.

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

Many people use something like denyhosts or fail2ban to help with brute force attacks. PF has built-in support for building rules with options which will throw potential attackers into a 'penalty box' based on certain factors like connection rate.

You can use iptables for that:

  $ sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH

  $ sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP
Copied from http://kvz.io/blog/2007/07/28/block-brute-force-attacks-with... but I agree that pf ist just much more sane config wise.

Re: Why you will love nftables

#13

Post by zdw »

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

Given that the kernel portion of nftables appears to just be a byte code interpreter, it probably would be possible to make something that takes pf syntax and puts out nftables byte code.

I think that would be pretty slick. As a long time pf user, I've always preferred it's syntax, and the nftables syntax looks like a step in the right direction at least, given the horror that was previous syntax methods.

Re: Why you will love nftables

#14

Post by simcop2387 »

hebz0rl wrote: post #12
xiljin wrote: post #10

Earlier quoted context omitted.

Many people use something like denyhosts or fail2ban to help with brute force attacks. PF has built-in support for building rules with options which will throw potential attackers into a 'penalty box' based on certain factors like connection rate.

You can use iptables for that: $ sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH $ sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP Copied from http://kvz.io/blog/2007/07/28/block-brute-force-attacks-with... but I agree that pf ist just much more sane config wise.

Since nftables is supposed to be backwards compatible, I'd guess it can do this too. I wonder what it'll look like for that. A lot of the other syntax looks nicer, i suspect that this will be better too.

Re: Why you will love nftables

#15

Post by zobzu »

simcop2387 wrote: post #6
jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

its not about what can be done, its about the learning curve and conciseness of the rules. pf has nice user space tools and easy, powerful syntax.

netfilter's iptables syntax well.. over the last, what, 10 years? we all got used to it. seems like nftables is going to required another 5 to become more or less known among people...

Re: Why you will love nftables

#16

Post by networked »

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

>I would really love to see "pf" on Linux.

Well, there's at least a Linux port of FreeBSD's ipfw and dummynet: http://info.iet.unipi.it/~luigi/dummynet/. I tried it briefly on my home server (Ubuntu 12.04 LTS with a stock 3.2.0 kernel) and it appeared to work as expected with rulesets written for FreeBSD.

Re: Why you will love nftables

#17

Post by wmf »

strcat wrote: post #9
lelf wrote: post #5

Earlier quoted context omitted.

Sorry, NIH. And we won't see dtrace either

DTrace and ZFS are both available for Linux as out-of-tree kernel modules. Sun intentionally used a GPL-incompatible license... it has nothing to do with NIH.

Even the Linux clones of DTrace are gratuitously incompatible when it probably would have been easier for users to clone DTrace exactly.

Re: Why you will love nftables

#19

Post by welterde »

jebblue wrote: post #18
welterde wrote: post #2

Being able to load a whole configuration with nft -f instead of having to hack a script to do the same is also a nice feature (makes it more pf-like)

This is easy with iptables too: iptables-restore

Yeah.. true.. still prefer the config file format[1] nftables brings along though.

[1] https://home.regit.org/netfilter-en/nftables-quick-howto/

Post reply on HN