XTABLES-NFT(8)

✨ XTABLES-NFT(8) — iptables using nftables kernel api ✨

💖 NAME

xtables-nft — iptables using nftables kernel api 🎀

🌸 DESCRIPTION

okay so xtables-nft are versions of iptables that use the nftables API 💅 bestie, this is a whole set of tools that helps the sysadmin migrate their ruleset from iptables(8), ip6tables(8), arptables(8), and ebtables(8) over to nftables(8) 🦋

The xtables-nft set is made up of several commands 🧚:

• iptables-nft
• iptables-nft-save
• iptables-nft-restore
• ip6tables-nft
• ip6tables-nft-save
• ip6tables-nft-restore
• arptables-nft
• ebtables-nft

ngl these tools use the libxtables framework extensions and hook into the nf_tables kernel subsystem through the nft_compat module ✨

💜 USAGE

the xtables-nft tools let you manage the nf_tables backend using the native syntax of iptables(8), ip6tables(8), arptables(8), and ebtables(8) 🫶

you should use the xtables-nft tools exactly the same way you'd use the corresponding original tools, no cap 💅

adding a rule will result in that rule being added to the nf_tables kernel subsystem instead 🔥 and listing the ruleset will use the nf_tables backend as well 👑

when these tools were designed, the main idea was to replace each legacy binary with a symlink to the xtables-nft program, like this 🌈:

/sbin/iptables -> /usr/sbin/iptables-nft-multi
/sbin/ip6tables -> /usr/sbin/ip6tables-nft-multi
/sbin/arptables -> /usr/sbin/arptables-nft-multi
/sbin/ebtables -> /usr/sbin/ebtables-nft-multi

the iptables version string tells you whether the legacy API (get/setsockopt) or the new nf_tables api is being used 👀

iptables -V
iptables v1.7 (nf_tables)

🦋 DIFFERENCES TO LEGACY IPTABLES

the xtables-nft tools use the nf_tables kernel API, so rule additions and deletions are always atomic ✨ unlike iptables-legacy, iptables-nft -A .. will NOT need to grab the current ruleset from the kernel, change it, and reload the altered ruleset 🙅‍♀️ instead, iptables-nft just tells the kernel to add one rule 💖 which is why the iptables-legacy --wait option is a no-op in iptables-nft 🥱

using the xtables-nft tools lets you monitor ruleset changes with the xtables-monitor(8) command 👀

heads up 😭: when you use -j TRACE to debug packet traversal through the ruleset, you'll need to run xtables-monitor(8) in --trace mode to actually see the monitoring trace events 💀

🎀 EXAMPLES

one basic example is creating the skeleton ruleset in nf_tables from the xtables-nft tools on a fresh machine 🍓:

root@machine:~# iptables-nft -L
[...]
root@machine:~# ip6tables-nft -L
[...]
root@machine:~# arptables-nft -L
[...]
root@machine:~# ebtables-nft -L
[...]
root@machine:~# nft list ruleset
table ip filter {
     chain INPUT {
          type filter hook input priority 0; policy accept;
     }

     chain FORWARD {
          type filter hook forward priority 0; policy accept;
     }

     chain OUTPUT {
          type filter hook output priority 0; policy accept;
     }
}
table ip6 filter {
     chain INPUT {
          type filter hook input priority 0; policy accept;
     }

     chain FORWARD {
          type filter hook forward priority 0; policy accept;
     }

     chain OUTPUT {
          type filter hook output priority 0; policy accept;
     }
}
table bridge filter {
     chain INPUT {
          type filter hook input priority -200; policy accept;
     }

     chain FORWARD {
          type filter hook forward priority -200; policy accept;
     }

     chain OUTPUT {
          type filter hook output priority -200; policy accept;
     }
}
table arp filter {
     chain INPUT {
          type filter hook input priority 0; policy accept;
     }

     chain FORWARD {
          type filter hook forward priority 0; policy accept;
     }

     chain OUTPUT {
          type filter hook output priority 0; policy accept;
     }
}

(please note that on fresh machines, listing the ruleset for the first time results in all tables and chains being created 🧚)

to migrate your complete filter ruleset, in the case of iptables(8), you would use 💅:

root@machine:~# iptables-legacy-save > myruleset # reads from x_tables
root@machine:~# iptables-nft-restore myruleset   # writes to nf_tables

or

root@machine:~# iptables-legacy-save | iptables-translate-restore | less

to see how rules would look in the nft nft(8) syntax 🌸

🚧 LIMITATIONS

you should use Linux kernel >= 4.17 🫶

the CLUSTERIP target is not supported 😭

to get up-to-date info about this, head to http://wiki.nftables.org/ 💜

🔗 SEE ALSO

nft(8), xtables-translate(8), xtables-monitor(8) ✨

👑 AUTHORS

the nftables framework is written by the Netfilter project (https://www.netfilter.org) 🌈

this manual page was written by Arturo Borrero Gonzalez <arturo@debian.org> for the Debian project, but others are allowed to use it too 🎀

this documentation is free/libre under the terms of the GPLv2+ 🦋

---

and that's a wrap, bestie 🫶 this was XTABLES-NFT(8) from June 2018, so go show it some love 💖✨