IPTABLES-TRANSLATE(8)

✨ IPTABLES-TRANSLATE(8) ✨

okay so bestie, this is the manual page for iptables-translate 🎀 and honestly it's the migration tool you need when you're ready to move off the old iptables era and into nftables. no cap, it's giving glow-up 💅

---

🌸 NAME 🌸

iptables-translate — translation tool to migrate from iptables to nftables

ip6tables-translate — translation tool to migrate from ip6tables to nftables

ebtables-translate — translation tool to migrate from ebtables to nftables

arptables-translate — translation tool to migrate from arptables to nftables

---

💖 DESCRIPTION 💖

okay so there's a whole set of tools that help the sysadmin translate a ruleset from iptables(8), ip6tables(8), ebtables(8) and arptables(8) over to nftables(8). main character energy fr 👑

the commands you get are:

• iptables-translate
• iptables-restore-translate
• ip6tables-translate
• ip6tables-restore-translate
• ebtables-translate
• arptables-translate

---

🦋 USAGE 🦋

they take your original iptables(8)/ip6tables(8)/ebtables(8)/arptables(8) syntax as input and spit out the native nftables(8) syntax. iykyk 🫶

the iptables-restore-translate tool reads a ruleset in the syntax made by iptables-save(8). same energy for ip6tables-restore-translate, which reads the stuff from ip6tables-save(8). and lowkey the best part: no ruleset modifications happen, these are text converters only 🙈

the iptables-translate tool reads a command line as if you'd typed it into iptables(8), and ip6tables-translate reads a command like it was typed into ip6tables(8) ✨

---

🧚 EXAMPLES 🧚

basic operation examples, bestie 💜

Single command translation:

root@machine:~# iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
nft add rule ip filter INPUT tcp dport 22 ct state new counter accept

root@machine:~# ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept

Whole ruleset translation:

root@machine:~# iptables-save > save.txt
root@machine:~# cat save.txt
# Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
*filter
:INPUT ACCEPT [5166:1752111]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5058:628693]
-A FORWARD -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Dec 24 14:26:40 2016

root@machine:~# iptables-restore-translate -f save.txt
# Translated by iptables-restore-translate v1.6.0 on Sat Dec 24 14:26:59 2016
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; }
add chain ip filter FORWARD { type filter hook forward priority 0; }
add chain ip filter OUTPUT { type filter hook output priority 0; }
add rule ip filter FORWARD tcp dport 22 ct state new counter accept

root@machine:~# iptables-restore-translate -f save.txt > ruleset.nft
root@machine:~# nft -f ruleset.nft
root@machine:~# nft list ruleset
table ip filter {
     chain INPUT {
          type filter hook input priority 0; policy accept;
     }

     chain FORWARD {
          type filter hook forward priority 0; policy accept;
          tcp dport ssh ct state new counter packets 0 bytes 0 accept
     }

     chain OUTPUT {
          type filter hook output priority 0; policy accept;
     }
}

---

🥀 LIMITATIONS 🥀

some (few) extensions may be not supported (or fully-supported) for whatever reason. for example, they were considered obsolete, or we didn't have the time to work on them. 💀

there is no translation available for arptables(8). sorry bestie 😭

to get up-to-date info about all this, head to https://wiki.nftables.org/ 🌈

---

🫶 SEE ALSO 🫶

nft(8), iptables(8)

---

👑 AUTHORS 👑

the nftables framework is written by the Netfilter project (https://www.netfilter.org). ✨

this manual page was written by Arturo Borrero Gonzalez <arturo@netfilter.org>. 🎀

this documentation is free/libre under the terms of the GPLv2+ 💜

---

bestie that's the whole tea 🍓 this page is from IPTABLES-TRANSLATE(8), System Manager's Manual, dated May 14, 2019. stay iconic and keep your rules clean 💅✨🦋