Nftables

nftablesOriginal author(s)| The Netfilter Project

|

Developer(s)| The Netfilter Project
Preview release|

Git repo

Written in| C
Operating system| Linux
Platform| Netfilter
Type| packet filtering
License| GPLv2
Website|

* netfilter.org/projects/nftables
* wiki.nftables.org

nftables is a subsystem of the Linux kernel providing filtering and classification of network packets/datagrams/frames. It has been available since Linux kernel 3.13 released on 19 January 2014.[1]

nftables replaces the legacy iptables component of Netfilter. Among the advantages of nftables over iptables is less code duplication and easier extension to new protocols. Among the disadvantages of nftables is that DPI that was provided by "iptables string match" like SNI filtering is not supported.[2]

nftables is configured via the user-space utility nft, while legacy tools are configured via the utilities iptables, ip6tables, arptables and ebtables frameworks.

nftables utilizes the building blocks of the Netfilter infrastructure, such as the existing hooks into the networking stack, connection tracking system, userspace queueing component, and logging subsystem.

## Contents

* 1 nft
* 1.1 Command-line syntax
* 2 History
* 3 Overview
* 4 References
* 5 External links

## nft

### Command-line syntax

A command to drop any packets with destination IP address `1.2.3.4`:

nft add rule ip filter output ip daddr 1.2.3.4 drop

Note that the new syntax differs significantly from that of iptables, in which the same rule would be written:

iptables -A OUTPUT -d 1.2.3.4 -j DROP

The new syntax can appear more verbose, but it is also far more flexible. nftables incorporates advanced data structures such as dictionaries, maps and concatenations that do not exist with iptables. Making use of these can significantly reduce the number of chains and rules needed to express a given packet filtering design.

The `iptables-translate` tool can be used to translate many existing iptables rules to equivalent nftables rules.[3][4] Debian 10 (Buster), among other Linux distributions, uses nftables along with `iptables-translate` as the default packet filtering backend.[5]

## History

The project was first publicly presented at Netfilter Workshop 2008 by Patrick McHardy from the Netfilter Core Team.[6] The first preview release of kernel and userspace implementation was given in March 2009.[7] Although the tool has been called "the biggest change to Linux firewalling since the introduction of iptables in 2001", it has received little press attention.[8] Notable hacker Fyodor Vaskovich (Gordon Lyon) said that he is "looking forward to its general release in the mainstream Linux kernel".[8]

The project stayed in alpha stage, and the official website was removed in 2009. In March 2010, emails from the author on the project mailing lists showed the project was still active and approaching a beta release,[9][10] but the latter was never shipped officially. In October 2012, Pablo Neira Ayuso proposed a compatibility layer for iptables[11] and announced a possible inclusion of the project into mainstream kernel.

On 16 October 2013, Pablo Neira Ayuso submitted a nftables core pull request to the Linux kernel mainline tree.[12] It was merged into the kernel mainline on 19 January 2014, with the release of Linux kernel version 3.13.[1]

## Overview

The nftables kernel engine adds a simple virtual machine to the Linux kernel which is able to execute bytecode to inspect a network packet and make decisions on how that packet should be handled. The operations implemented by this virtual machine are intentionally made basic. It can get data from the packet itself, have a look at the associated metadata (inbound interface, for example), and manage connection-tracking data. Arithmetic, bitwise and comparison operators can be used for making decisions based on that data. The virtual machine is also capable of manipulating sets of data (typically, IP addresses), allowing multiple comparison operations to be replaced with a single set lookup.[13]

The above-described organization is contrary to the iptables firewalling code, which has protocol awareness built-in so deeply into the logic that the code has had to be replicated four times--for IPv4, IPv6, ARP, and Ethernet bridging--as the firewall engines are too protocol-specific to be used in a generic manner.[13]

The main advantages of nftables over iptables are the simplification of the Linux kernel ABI, reduction of code duplication, improved error reporting, and more efficient execution, storage and incremental changes of filtering rules. Traditionally used `iptables(8)`, `ip6tables(8)`, `arptables(8)` and `ebtables(8)` (for IPv4, IPv6, ARP and Ethernet bridging, respectively) are intended to be replaced with `nft(8)` as a single unified implementation, providing firewall configuration on top of the in-kernel virtual machine.

nftables also offers an improved userspace API that allows atomic replacements of one or more firewall rules within a single Netlink transaction. This speeds up firewall configuration changes for setups having large rulesets; it can also help in avoiding race conditions while the rule changes are being executed. nftables also includes compatibility features to ease transition from previous firewalls, command-line utilities to convert rules in the iptables format,[14] and syntax-compatible versions of iptables commands that use the nftables backend.[15]

## References

1. ↑ 1.0 1.1 "nftables, the successor of iptables". Linux 3.13. kernelnewbies.org. 2014-01-19. https://kernelnewbies.org/Linux_3.13#head-f628a9c41d7ec091f7a62db6a49b8da50659ec88.
2. ↑ "How We Used eBPF to Build Programmable Packet Filtering in Magic Firewall". https://blog.cloudflare.com/programmable-packet-filtering-with-magic-firewall.
3. ↑ "Moving from iptables to nftables - nftables wiki". https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables.
4. ↑ "List of available translations via iptables-translate tool - nftables wiki". https://wiki.nftables.org/wiki-nftables/index.php/List_of_available_translations_via_iptables-translate_tool.
5. ↑ "Nftables - Debian Wiki". https://wiki.debian.org/nftables.
6. ↑ "User day program – NFWS2008". workshop.netfilter.org. 2008-10-03. https://workshop.netfilter.org/2008/User-day-program.html.
7. ↑ initial release announcement.
8. ↑ 8.0 8.1 Gray, Patrick (March 26, 2009). "NEWS: Linux Gets New Firewall". Risky.biz. https://risky.biz/news_and_opinion/patrick-gray/2009-03-26/news-linux-gets-new-firewall.
9. ↑ "Linux Netfilter Devel – Re: Current state of nftables". Spinics.net. https://www.spinics.net/lists/netfilter-devel/msg12409.html.
10. ↑ "Linux Netfilter Devel – Re: Current state of nftables". Spinics.net. https://www.spinics.net/lists/netfilter-devel/msg15690.html.
11. ↑ "Linux Netfilter Devel – [RFC] back on nf_tables (plus compatibility layer)". Spinics.net. https://www.spinics.net/lists/netfilter-devel/msg23831.html.
12. ↑ "[PATCH 00/17] netfilter updates: nf_tables pull request". Marc.info. https://marc.info/?l=netfilter-devel&m=138176887917614&w=2.
13. ↑ 13.0 13.1 Jonathan Corbet (2013-08-20). "The return of nftables". LWN.net. https://lwn.net/Articles/564095/.
14. ↑ Neira Ayuso, Pablo. "nftables – nft command line tool". https://git.netfilter.org/nftables/commit/?id=b65a70131d0d38844be12235270eebaa9d2f5a4d.
15. ↑ Arturo, Ral. "Netfilter Workshop 2018 Berlin summary". https://ral-arturo.org/2018/06/16/nfws2018.html.

## External links

* First release of nftables (2009-03-18)
* Pablo Neira Ayuso: [RFC] back on nf_tables (plus compatibility layer)
* nftables quick HOWTO
* nftables sections in ArchWiki and Gentoo Wiki
* Corbet, Jonathan (2009-03-24). "nftables: a new packet filtering engine". LWN.net. https://lwn.net/Articles/324989/.
* McHardy, Patrick (2008-09-30). "nftables – a successor to iptables, ip6tables, ebtables and arptables" (ODP). Netfilter Workshop 2008. http://people.netfilter.org/kaber/nfws2008/nftables.odp.
* nft_compat extended to support ebtables extensions (merged in Linux kernel 4.0)
* Extended and enhanced manual for the nft command line tool

* v
* t
* e

Firewall software

* Application firewall
* Context-based access control
* Personal firewall
* Stateful firewall
* Virtual firewall

Linux|

| Apps|

* FireHOL
* Firestarter
* firewalld
* Netfilter
* ipset
* iptables
* L7-filter
* NuFW
* MoBlock
* nftables
* Privoxy
* Shorewall
* Squid
* Uncomplicated Firewall

|

Distros|

* Endian Firewall
* IPFire
* LEDE
* OpenWrt
* SmoothWall
* Untangle
* Zeroshell

BSD|

| Apps|

* IPFilter
* ipfirewall
* NPF
* PF
* CARP
* pfsync

|

Distros|

* M0n0wall
* OPNsense
* pfSense
* SmallWall

macOS|

* Little Snitch
* NetBarrier X4
* PeerGuardian
* VirusBarrier X6

Windows|

| Commercial|

* Check Point Integrity
* Kaspersky Internet Security
* McAfee Personal Firewall Plus
* Microsoft Forefront Threat Management Gateway
* Norton 360
* Norton Internet Security
* Norton Personal Firewall
* Outpost Firewall Pro
* Symantec Endpoint Protection
* Trend Micro Internet Security
* Windows Firewall
* Windows Live OneCare
* WinGate
* WinRoute

|

Freemium|

* Comodo Internet Security
* ZoneAlarm

Open-source|

* PeerBlock
* PeerGuardian

Appliances|

* Palo Alto PA-Series
* F5 BIG-IP iSeries
* FortiGate Series
* Novell BorderManager
* Vyatta
* ZoneAlarm Z100G
* Zorp firewall

* Comparison of firewalls
* List of router or firewall distributions

* v
* t
* e

Linux kernel

Organization|

| Kernel|

* Linux Foundation
* Linux Mark Institute
* Linus's law
* Tanenbaum–Torvalds debate
* Tux
* SCO disputes
* Linaro
* GNU GPL v2
* menuconfig
* Supported computer architectures
* Kernel names
* Criticism

|

Support|

* Developers
* The Linux Programming Interface
* kernel.org
* LKML
* Linux conferences
* Users
* Linux User Group (LUG)

Technical|

| Debugging|

* CRIU
* ftrace
* kdump
* Linux kernel oops
* SystemTap
* BPF

|

Startup|

* vmlinux
* System.map
* dracut
* initrd
* initramfs

ABIs|

* Linux Standard Base
* x32 ABI

APIs|

| Of
userspace|

| FS,
daemons|

* devfs
* devpts
* debugfs
* procfs
* sysfs
* systemd
* udev
* Kmscon

|

Wrapper
libraries|

* C standard library
* glibc
* uClibc
* Bionic
* libhybris
* dietlibc
* EGLIBC
* klibc
* musl
* Newlib
* libcgroup
* libdrm
* libalsa
* libevdev
* libusb

kernel|

| System Call
Interface|

* POSIX
* ioctl
* select
* open
* read
* close
* sync
* …
* Linux-only
* futex
* epoll
* splice
* dnotify
* inotify
* readahead
* …

|

In-kernel|

* ALSA
* Crypto API
* DRM
* kernfs
* Memory barrier
* New API
* RCU
* Video4Linux

Components|

* Kernel modules
* BlueZ
* cgroups
* Console
* bcache
* Device mapper
* dm-cache
* dm-crypt
* DRM
* EDAC
* evdev
* Kernel same-page merging (KSM)
* LIO
* Framebuffer
* LVM
* KMS driver
* Netfilter
* Netlink
* nftables
* Network scheduler
* perf
* SLUB
* zram
* zswap

* Process and I/O schedulers:
* O(n) scheduler
* O(1) scheduler
* Completely Fair Scheduler (CFQ)
* Brain Fuck Scheduler
* Noop scheduler
* SCHED_DEADLINE

* Security Modules: AppArmor
* Exec Shield
* grsecurity
* PaX
* seccomp
* SELinux
* Smack
* Tomoyo Linux
* Linux PAM

* Device drivers
* 802.11
* graphics
* Raw device

* initramfs
* KernelCare
* kexec
* kGraft
* kpatch
* Ksplice

Variants|

* Mainline
* Linux kernel
* Linux-libre
* High-performance computing
* INK
* Compute Node Linux
* SLURM
* Real-time computing
* RTLinux
* RTAI
* Xenomai
* Carrier Grade Linux
* MMU-less
* μClinux
* PSXLinux

| Virtualization|

* Hypervisor
* KVM
* Xen
* OS-level virtualization
* Linux-VServer
* Lguest
* LXC
* OpenVZ
* Other
* L4Linux
* ELinOS
* User-mode Linux
* MkLinux
* coLinux

|

Adoption|

| Range
of use|

* Desktop
* Embedded
* Gaming
* Thin client:
* LTSP
* Thinstation
* Server:
* LAMP
* LYME-LYCE
* Devices

|

Adopters|

* List of Linux adopters
* GENIVI Alliance
* Proprietary software for Linux

* Category
* Commons
* Book
* Wikiversity
* Portal

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Nftables. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Software:Nftables&oldid=4136379"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template