NFTables To Replace iptables In the Linux Kernel

An anonymous reader writes "NFTables is queued up for merging into the Linux 3.13 kernel. NFTables is a four-year-old project by the creators of Netfilter to write a new packet filtering / firewall engine for the Linux kernel to deprecate iptables (though it now offers an iptables compatibility layer too). NFTables promises to be more powerful, simpler, reduce code complication, improve error reporting, and provide more efficient handling of packet filter rules. The code was merged into net-next for the Linux 3.13 kernel. Iptables will still be present until NFTables is finished, but it is possible to try it out now. LWN also has a writeup on NFTables."

Comments

again?

[Leroy Brown]

ipfwadm.. ipchains.. iptables.. nftables... progress sucks. :(

Re:again?

[Anonymous Coward]

And the iptables docs haven't even been finished yet. I was at the North Carolina Biotechnology Center at the Linux Expo in 1997 when one of the speakers that was talking about iptables promised they would write docs for it. I think I was the only teen girl and only black female there, so if you were there, you'll probably remember me. How about finishing what you start rather than screwing the users with half-ass unfinished projects?

Re:again?

[jamesh]

Documentation: There is a quick howto available at Eric Leblond's website.

Yeah I guess a "quick howto" isn't quite going to cut it. I wonder if Linus would ever put his foot down and say "no docs = no patch accept".

Re:again?

[petermgreen]

I've always found the iptables tutorial from frozentux to be reasonablly comprehensive, maybe it's missing some really fancy stuff but the important stuff about the theory of operation and what the targets do is all there.

Re:again?

[Anonymous Coward]

Don't you know? Open-source software doesn't need docs, because the best docs available are the sources.

Re: again?

[Anonymous Coward]

And is that pronounced "useless"?

Re:again?

[skids]

There is an intersection between the tasks iptables/ebtables/arptables can perform, so someties you need to decide which responsibility you want to delegate to which.

But you are correct, ebtables was never a replacement.for iptables.

This diagram is very useful when you get deep in the weeds.

Re:again?

[evilviper]

ipfwadm.. ipchains.. iptables.. nftables... progress sucks. :(

Not trying to troll or flame here, BUT...

That's not the fault of "progress", it's just a Linux thing... Same thing happened with audio, file systems, and much more.

The BSDs:

* haven't changed their audio systems since their inception.

* Kept their file systems backwards-compatible for decades, and did not have a flood of XFS/JFS/ReiserFS/etc. options. There have been changes recently, but incredibly few by comparison.

* Used the powerful and simple IPF as their stateful firewall dating back before many /.ers were born... at least 1993 or so. Only changed to PF (with very similar syntax) after IPF's license was changed, and all the BSD still use it. There are some alternative projects, but again, even with several BSDs, there's still less churn than with Linux.

Re:again?

[Anonymous Coward]

Don't you know? Open-source software doesn't need docs, because the best docs available are the sources.

It's the most comphrehensive, but also one of the more incomphrehensible not fluent in code.

Yes, because then you can say that subtle bugs are actually features! It is great!

Seriously, I know both of you are joking. But this is a bad joke that should be put down once and for all. Documentation describing the intended function of a program can help you find the bugs that cause inconsistent behavior. Using source as documentation is not even an option the most skilled programmers. As long as we do not have mind-reading skills there is no way of knowing what the original programmer intended.

Captcha: naivete

Re:again?

[Kjella]

And they're down to 1.1% of all web servers, all FreeBSD. From the list of "Popular websites using FreeBSD" only one is in Alexa's top 500 and that's php.net. The Alexa rankings:

php.net: 229
turbobit.net: 557
jvzoo.com: 771
cpanel.net: 1096
neoseeker.com: 5488
starpulse.co: 5818
salespider.com: 4710
weblancer.net: 5125
extranetinvestment.com: 5834
msi.com: 6702

It is literally less than a handful (the top four) that means BSD even still has a presence and 80% of that is probably just one site. I guess BSD code is lots of places like in OS X and embedded and routers and whatnot but BSD is practically dead as a server (cue and queue the Netcraft and Monty Python jokes, please take a number). Who, at this point, would be interested in building a new network stack for BSD? I guess Juniper would since they use it for Junos, but honestly not that many others...

Re:again?

[fatphil]

That's not documentation, that's rambling bollocks.

Going to a random page: "If the IP filter implementation is strictly following the definition, it would in other words ..."

No, "in other words" is only appropriate after you've worded things once and are about to re-iterate using different terminology, in other words are using "other words" to describe the same thing.

Re:again?

[rmadmin]

http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/nutshell.html#introduction-nutshell-users You also forgot some biggies, like Netflix, oh and Apache themselves. Sampling an OS's usage numbers off of how many public facing web servers are out there will give you very biased results. I have two FreeBSD servers running OpenBGPd and OpenOSPFd, and two that are NFS servers, there is absolutely no web server on them. They are ROCKS of stability. This is just FreeBSD, a partner ISP I work with runs OpenBSD route reflectors.

Re:again?

[fisted]

Who, at this point, would be interested in building a new network stack for BSD?

Nobody. Because it is excellent already. Ask ISPs.
Your argument for change for change's sake is invalid.
Also it's an obvious fallacy to restrict yourself to looking at www only.

Either you're stupid/ignorant, or you really are a troll. I'll give you the benefit of the doubt.

Re:again?

[ras]

Hear hear! A bit of background to the politics of this:

NFTables is brought to you by a group of codes created when Alexey Kuznetsov decided to replaced the low level linux network stack for Linux 2.2 to make it more like what Cisco provided in IOS. The result added whole pile of new functionality to Linux (eg routing rules), and a shiny new highly module traffic control engine. Alexey produced a beautifully written postscript documentation for the new user land routing tools (the "ip" command), and 100 line howto for the far more complex traffic control engine tools (the "tc" command).

Technically it was a was tour de force. But to end users it could at best be called a modest success. Alexey re-wrote the net-utils tools ("ifconfig", "route" and friends) to use the new system, and did such a good job very few bothered to learn the new "ip" command even though the documentation was good and it introduced a modest amount of new features. But real innovation was the traffic control engine, and to this day bugger all people know how to use it.

At this point it could have gone two ways. Someone could have brought tc's documentation up to the same standard Alexey provided for ip, or they could ignore the fact that almost no one used the code already written and add more of the same. They did the latter.

It was also at this time the network code wars started in the kernel. Not many people know that a modest amount of NAT, filtering and so on can be done by Alexey's new ip command. But rather than build on that Rusty Russell just ported the old ipfwadm infrastructure, called it ipchains (and later replaced it with iptables). There was some overlap between Rusty's work and tc, and this has grown over time. For example the tc U32 filter could do most of the packet tests ipchain's introduced over time on day 1. Technically the modular framework provided by tc was more powerful than ipchains, and inherently faster. Tc was however near impossible for mere mortals to use even if they had good documentation. There were some outside efforts to fix this - tcng was an excellent out-of-tree attempt to fix the complexity problems of tc. But in what seems like a recurring theme, it was out of tree and ignored. In contrast, Rusty provided ipchains with the some best documentation on the planet. In the real world the result of these two efforts are plain to see - while man + dog uses iptables, there maybe 100 people on the planet who can use tc.

Another example of the same thing is IMQ. IMQ lets you unleash the full power of the traffic control engine on incoming traffic. (Natively the traffic control engine only deals with packets being sent, not incoming packets - a limitation introduced for purely philosophical reasons). IMQ was very well documented, and heavily used. The people who brought you tc had a list of technical objections to IMQ. I don't know whether they were real or just a case of Not Invented Here, but I'd give them the benefit of the doubt - they are pretty bright guys. So they replaced it with their own in-kernel-tree concoction. (For those of you who don't follow the kernel "in-tree" means it comes with the Linux Kernel. An out-of-tree module like IMQ means at the very least you have to compile the module source, and possibly the entire kernel.) For a while this discouraged the developers of IMQ so much they stopped working on it. If you follow that link, you will see it's back now. Why? Because the thing that replaced it had absolutely no documentation. They never do. So no one could use the replacement. Again, in the end, the thing code that was documented won the day.

By now you might be guess where this is heading. We have two groups in the kernel competing to provide the

Bah

[Billly Gates]

IPChains work just fine thank you very much!

Kernel 2.4 works fine for my needs. You kids today have no idea what it is like upgrading thousands of computers at work! Especially when you have to justify to a beancounter to upgrade an IP table that has worked fine since October 2001 and already works. It is an enterprise standard that works so why fix what isn't broken?

Last thing I need is another confusing IP table interface designed for teenagers.

With a modern AV I should be just fine if I do not go to questionable websites.

Re:Bah

[d33tah]

You don't worry about security too much, do you? As far as I know, 2.4 is not supported anymore.

Re:Bah

[icebike]

Being unsupported is not a death sentence.

As long as iptables/ipchains works, and/or you don't have a ton of open ports, there's really no problem running old kernels.
80% of the routers in the world are running some really old kernels and have/will never get updates. Baring any newly discovered backdoors,
they are as secure today as they ever were.

Re:Bah

[freakingme]

It's not like BSD is getting a new firewall as well? https://en.wikipedia.org/wiki/NPF_(firewall)

Re:Bah

[lgw]

All malware today uses ports 80 and 443. Port-based firewalling is a meaningless ritual from the previous century.

Re:Bah

[Kjella]

All malware today uses ports 80 and 443. Port-based firewalling is a meaningless ritual from the previous century.

I think you're confusing cause and effect, if we didn't have port based firewalls we'd still have Blaster-style worms spreading like wildfire. Because we've locked things down to a few approved ports, naturally that's where they try getting in.

Re:Bah

[MikeBabcock]

That's not true -- port based firewalling prevents inbound packets to services you want to run but don't want to be accessed from the outside.

Noooooo

[binarylarry]

All my precious iptables knowledge gone!

Linus hates us precious! Hates us!

Re:Noooooo

[binarylarry]

Okay so after RTFMing, I like the changes.

It reminds me of the ip command, which is so much better than route.

NFTables FTW!

Re:Noooooo

[phantomfive]

Here's something interesting:

IPv6 NAT is possible

I didn't realize they were working on that.

Re:Noooooo

[jones_supa]

All my precious iptables knowledge gone!

Linus hates us precious! Hates us!

1 minute later...

Okay so after RTFMing, I like the changes.

NFTables FTW!

Re:Noooooo

[dbIII]

It's as useless as having the option of having car windows painted black, but people wanted it so it's there (so I've heard - I'm an end user not a developer of this).
When NAT came in it was a pity we needed that shit due to a lack of numbers instead of having everything adressable, and now for some reason people like the smell of that shit. They think it smells like security.
If you think I'm wrong please spend at least five minutes learning how a firewall works and look up router on wikipedia or something before you reply. You should work out from that that the devices that provide the security will still be upstream whether you have NAT or not.

Re:Noooooo

[phantomfive]

The only thing I've ever heard that makes any sense is topology hiding. Not worth breaking the internet IMO, but it's the only thing about NAT that I can understand why people want, and can't really be done another way.

pf

[Alioth]

Can't we have OpenBSD pf instead? Powerful, nice, decent documentation on how to use it, syntax that makes a lot more sense than iptables.

Re:pf

[Anonymous Coward]

Can't we have OpenBSD pf instead? Powerful, nice, decent documentation on how to use it, syntax that makes a lot more sense than iptables.

That would be nice. I was very happy when pf was imported into NetBSD (my preferred BSD). iptables is just meh in comparison. I'll reserve judgment on this NFTables until I see it for myself.

Re:pf

[utkonos]

You can.

1) Use OpenBSD

2) Use FreeBSD

3) Use Debian with a FreeBSD kernel. This is debian and the kernel has PF. You get everything you want.

Re:pf

[Pricetx]

If you weren't already +5 informative, I would have up-voted you. pf has syntax so logical it's almost like speaking English. Then, in comparison, you have to memorize a variety of command flags to get anything done with iptables.

Mind you, personally i'm a FreeBSD user and (I think?) you can't actually get iptables for *BSD, and I don't have much use for a complicated firewall setup,

I really like the idea

[vadim_t]

The main advantage of this is moving protocol knowledge out of the kernel into userspace.

Which means that the kernel doesn't need a million modules that understand the various bits of various protocols. If something new comes up, the userspace compiler can patched to deal with it.

It should also make the kernel part much smaller and easier to make secure.

Re:I really like the idea

[icebike]

It should also make the kernel part much smaller and easier to make secure.

You hope.
I've learned to become suspicious of change for change sake.
Long running well debugged code is almost always better understood than new code.

Re:I really like the idea

[gweihir]

Indeed. I see several possible outcomes:
- This never reaches the quality level of iptables
- It becomes fast and stable enough to use, but nobody cares
- It replaces iptables in the distant future

Iptables is not broken. Do not fix it.

Re:I really like the idea

[gweihir]

This is not an improvement. This is a replacement. Replacing things that are not broken is stupid.

drunken troubleshooting in 3 years

[RITjobbie]

I can't get to slashdot. Let's troubleshoot!
[root@wang]# ifconfig
bash: ifconfig: command not found

[root@wang]# iptables -F
bash: iptables: command not found

Re:drunken troubleshooting in 3 years

[DeHackEd]

> [root@wang]# iptables -F

Suddenly your INPUT chain policy of DROP kills all traffic and your ssh session drops. (You do have a default policy of DROP, right?)

Seriously, don't do that on an unknown system.

(I post this because I've had vendors' support try to remedy problems by disabling the firewall. :/)

Re:drunken troubleshooting in 3 years

[epyT-R]

The problem with that is now you have no means of getting into your machine remotely over ip after the vendor fucks it up. Vendors shouldn't be disabling firewalls as permanent solutions, but while troubleshooting, it does make sense to do it temporarily in order to ensure the firewall is not at fault. If your system is a highly sensitive target, you should already have means in place to troubleshoot problems without exposing yourself. Tell the vendor the procedures for that.

done that, now explicitly drop all, default accept

[raymorris]

I've done that to Very Important Client.
Now I explicitly have a drop everything rule, with default accept. That way -F doesn't bite me.

IPTABLES too complex and shouldn't be in kernel

[knorthern knight]

I've been using linux since 2000. Two comments...

1) IPCHAINS was nice, simple, and usable. IPTABLES has stuff scattered all over the place. This may affect me more as a Gentoo user who configures his own kernel. I have to remember to...
a) enable Netfilter
b) enable "Advanced netfilter configuration" so that I can specify multi-port matches
c) check off the necessary items in "Core Netfilter Configuration"
d) check off the necessary items in "IP: Netfilter Configuration"
That's on a simple home system that doesn't attempt NAT/Masq/Routing/etc.

2) A problem with putting detailed specifications into the kernel is that when I want to enable new features (not just new rules), I have to tweak the kernel, rebuild it, and reboot. If we had to do this with new MTAs or crons or other system programs, there would be a huge outcry. Moving this out of the kernel looks logical.

Re:You go girl :D

[philip.paradis]

Don't worry, iptables and arptables aren't going to magically disappear. A ridiculous amount of infrastructure depends on both, and the nftables announcement is severely over-hyped. Having alternatives is a good thing, and it doesn't mean the sky is falling.

Re:Cat got your tongue? Cat got your tongue?

[maxwell demon]

JUST MAKE a DECENT FUCKING GUI with DOCUMENTATION.

I don't think fucking needs a new GUI. The current touch-based interface works just fine. Most people don't need any documentation for it, but if you really need it, I think there's a lot of third-party stuff explaining every fucking detail. There are even videos demonstrating its use, look under "porn".

Come on now...

[Max Threshold]

Can we unfuck PulseAudio before we go replacing something else that ain't broke? What's it been, ten years? and that PA shit still don't work...

Look to the real culprit

[BrokenHalo]

somebody decides they have a better way, and rather than keeping the two available until one stops being maintained they go and dump one as 'inferior'

To be fair, the kernel developers have (to my knowledge) never done this. If you have ever compiled a kernel yourself, you will have seen that new features are flagged as "experimental", older features as "deprecated", and defaults are applied judiciously.

You will most likely find that it is your distribution that is most guilty of foisting bleeding-edge, half-tested stuff on to its users. Linus and the kernel devs are (and have to be) almost fanatically conservative.

Said one developer...

[Chris Mattern]

"Too many people had figured out how to configure a host firewall, so we had to change it all around again."