Nft - Revision history

ViciousCarnivore: /* Listing Rules */

2026-01-19T06:39:27Z

Listing Rules

2026-01-19T06:38:41Z

iptables vs nft: which is easier for the sysadmin?

2024-09-11T07:15:01Z

Throttle traffic

2023-10-26T03:20:03Z

Throttle Traffic

2023-10-26T03:19:52Z

Throttle Traffic

2023-10-26T03:19:11Z

List rules

2023-08-10T16:06:14Z

Usage

2023-05-26T21:29:03Z

Delete rules in a chain only

2023-05-26T21:28:17Z

Delete all rules

2023-05-09T19:43:19Z

iptables vs nft: which is easier for the sysadmin?

@@ Line 181: / Line 181: @@
   iptables -L
   iptables -t nat -L
-  nft list tables inet filter or whatever the fuck else it is named.
+  nft list tables inet filter or whatever the %(*@% else it is named.
 So nft loses here. Worse is better. New worse.

← Older revision		Revision as of 06:38, 19 January 2026
Line 177:		Line 177:

	Nft has a higher learning curve, but seems to have more flexibility. It's a bit difficult to remember writing commands from the shell, so it favors scripting. I would imagine nft is geared towards power users. iptables remains a much easier introduction to firewall scripting, but having to write ip6tables and iptables scripts is a bit worse. I will have to wait until I understand both to make a judgement.		Nft has a higher learning curve, but seems to have more flexibility. It's a bit difficult to remember writing commands from the shell, so it favors scripting. I would imagine nft is geared towards power users. iptables remains a much easier introduction to firewall scripting, but having to write ip6tables and iptables scripts is a bit worse. I will have to wait until I understand both to make a judgement.
		+
		+	===Listing Rules===
		+	iptables -L
		+	iptables -t nat -L
		+	nft list tables inet filter or whatever the fuck else it is named.
		+	So nft loses here. Worse is better. New worse.

@@ Line 112: / Line 112: @@
          option unit 'kbytes'
 </pre>
 ==Templates==

@@ Line 76: / Line 76: @@
 need for iptables -v -L. +1
-===Throttle Traffic===
+===Throttle traffic===
 This is a +1 over iptables. Without requiring traffic control (tc) you can do throttling with nft.

@@ Line 79: / Line 79: @@
 This is a +1 over iptables. Without requiring traffic control (tc) you can do throttling with nft.
-This is taken from the luci-app-nft-qos scripts in owrt.
+This is taken from the luci-app-nft-qos scripts in owrt. Note that I've only seen it there, and haven't tested
   table inet nft-qos-static {
          chain upload {

@@ Line 10: / Line 10: @@
 which can convert an iptables rule to nft. Used like so:
   iptables-translate -I INPUT -p tcp --dport 22 -j DROP
-and it will give the nft equivalent.
+and it will give the nft equivalent. If you don't it, install iptables.
 Second, you should know that in order to block ipv4 and ipv6, you should
@@ Line 21: / Line 21: @@
   -I is nft insert
   -A is nft add
-Terrible... Add should be append.
+Add used to be append. Confusing.
 As with iptables, the order in which you execute the rules is important.
-Fourth: you have to make your own tables, AND chains because f&*$ you that's why.
+Fourth: you have to make your own tables, AND chains.
-What a mess.
 ===Create tables/chains===

@@ Line 65: / Line 65: @@
   nft flush chain inet filter input
 note that you need the inet / ip specification there.
 ===List rules===

@@ Line 59: / Line 59: @@
   vs
   nft flush ruleset
-fail. Should be just nft -F.
+fail. Should be just nft -F. I guess iptables has been 'nerft'. oh well.
 ===List rules===

← Older revision		Revision as of 19:43, 9 May 2023
Line 105:		Line 105:
	Which is better?		Which is better?

−	Nft has a higher learning curve, but seems to have more flexibility. It's a bit difficult to remember writing commands from the shell, so it favors scripting. I would imagine nft is geared towards power users. iptables remains a much easier introduction to firewall scripting, but having to write ip6tables and iptables scripts is a bit worse. I will have to wait until I understand both to make a judgement~~. Time will tell~~.	+	Nft has a higher learning curve, but seems to have more flexibility. It's a bit difficult to remember writing commands from the shell, so it favors scripting. I would imagine nft is geared towards power users. iptables remains a much easier introduction to firewall scripting, but having to write ip6tables and iptables scripts is a bit worse. I will have to wait until I understand both to make a judgement.