Why you will love nftables • Hacker News Board

Re: Why you will love nftables

#21

Post by Thaxll » Tue, Jan 21, 2014, 1:49 AM UTC

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I woudn't, pf is good and the learning curve is easier but Iptables is more advanced and powerful ( many modules that don't exist in pf )

Re: Why you will love nftables

#22

Post by Florin_Andrei » Tue, Jan 21, 2014, 1:50 AM UTC

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've used all of the above. pf is much, much over-rated. iptables is just about as capable. Plus, in a speed test I did a while ago, a Linux firewall vastly outperformed an OpenBSD firewall on the same hardware, in terms of amounts of traffic it could handle before keeling over and dying.

OpenBSD is neat, but creating a cult around it doesn't help with anything.

Re: Why you will love nftables

#23

Post by jerf » Tue, Jan 21, 2014, 2:00 AM UTC

nftables sounds like a great example of why you should learn compilers: http://steve-yegge.blogspot.com/2007/06/rich-programmer-food... You can write reams of code that work, but still have limits, and overcoming those limits would require further endless reams of code (iptables). Or you can write something simpler that breaks the problem down into primitives which a compiler will let you put together arbitrary ways, and despite being more flexible, is still less code (nftables).

Re: Why you will love nftables

#24

Post by purple_horse » Tue, Jan 21, 2014, 3:19 AM UTC

simcop2387 wrote: post #6

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

Anchors?

Tables?

Or my very favourite: last match wins, which shortens your ruleset considerably.

Re: Why you will love nftables

#25

Post by marios » Tue, Jan 21, 2014, 6:03 AM UTC

simcop2387 wrote: post #6

jlgaddis wrote: post #4

I would really love to see "pf" on Linux. When I began using Linux, "ipfwadm" had just been incorporated into the kernel. It was replaced in 2.2 by "ipchains" which was replaced in 2.4 by "iptables". Now we have "nftables". I'll admit to not knowing much about nftables but from what I've read about it in the last few days, it's still not even close to what OpenBSD's "pf" is capable of. Ahhh, well, I can wish, right?

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

I've found PF easier to get started with and more manageable due to the config syntax. Now onto something that PF can do but iptables can't: address family translation. There is a module somewhere on github that does NAT64, but is somewhat limited compared to PF. Now if you want to go the other way around, i.e. NAT46, it is currently not possible on Linux in kernelland.

Re: Why you will love nftables

#26

Post by simcop2387 » Wed, Jan 22, 2014, 8:42 PM UTC

purple_horse wrote: post #24

simcop2387 wrote: post #6

Earlier quoted context omitted.

I've heard this about every linux firewall, can you give some good examples of what either iptables or nftables can't do that pf can?

Anchors? Tables? Or my very favourite: last match wins, which shortens your ruleset considerably.

Anchors look suspiciously like creating a new chain in iptables. Tables there doesn't seem to be any direct analog, though can be done similarly by creating a chain that matches the list of addresses you're interested in and forwarding the rules there.

That said both of pf's versions look better than iptables. nftables looks like it does a better job of this like pf does, which is definitely a good thing.