Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #223728 > unrolled thread
| Started by | Tom Browder <tom.browder@gmail.com> |
|---|---|
| First post | 2020-06-20 16:30 +0200 |
| Last post | 2020-06-20 21:40 +0200 |
| Articles | 6 — 4 participants |
Back to article view | Back to linux.debian.user
What is the best practice for a firewall for Debian Buster: iptables or nftables? Tom Browder <tom.browder@gmail.com> - 2020-06-20 16:30 +0200
Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? l0f4r0@tuta.io - 2020-06-20 17:50 +0200
Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? Tom Browder <tom.browder@gmail.com> - 2020-06-20 21:40 +0200
Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? Andrei POPESCU <andreimpopescu@gmail.com> - 2020-06-20 22:20 +0200
Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? Ben Lavender <ben@airnet.org.uk> - 2020-06-20 19:50 +0200
Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? Tom Browder <tom.browder@gmail.com> - 2020-06-20 21:40 +0200
| From | Tom Browder <tom.browder@gmail.com> |
|---|---|
| Date | 2020-06-20 16:30 +0200 |
| Subject | What is the best practice for a firewall for Debian Buster: iptables or nftables? |
| Message-ID | <AjMFj-xu-1@gated-at.bofh.it> |
I see it's recommended that Buster users use nftables, but the default installation still uses iptables! I need to change ports on my new remote server to allow http and https traffic, but should I keep using iptables? Or should I remove iptables and install nftables first? If I keep iptables, should I add a firewall management program like ufw or something else? Is there something like ufw for nftables? Thanks. Best regards, -Tom
[toc] | [next] | [standalone]
| From | l0f4r0@tuta.io |
|---|---|
| Date | 2020-06-20 17:50 +0200 |
| Subject | Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? |
| Message-ID | <AjNUJ-1cD-3@gated-at.bofh.it> |
| In reply to | #223728 |
Hi, 20 juin 2020 à 16:24 de tom.browder@gmail.com: > I see it's recommended that Buster users use nftables, but the default > installation still uses iptables! > True & false. Actually, as explained on https://wiki.debian.org/nftables, Buster uses an "iptables-nft layer (i.e, using iptables syntax with the nf_tables kernel subsystem). This also affects ip6tables, arptables and ebtables." > I need to change ports on my new remote server to allow http and https > traffic, but should I keep using iptables? Or should I remove iptables > and install nftables first? > You decide. iptables is being progressively superseded by nftables. However, the former is still heavily used. nftables is the future, that's why I've chosen it. But it requires a little more effort (new syntax) if you are used to iptables, even if it's considered easier and that some tools help regarding the migration... > If I keep iptables, should I add a firewall management program like > ufw or something else? Is there something like ufw for nftables? > Again you decide considering what you are comfortable with. I don't think ufw works with nftables but you have firewalld instead that works with both I've been told. Or you can use nftables directly... Best regards, l0f4r0
[toc] | [prev] | [next] | [standalone]
| From | Tom Browder <tom.browder@gmail.com> |
|---|---|
| Date | 2020-06-20 21:40 +0200 |
| Subject | Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? |
| Message-ID | <AjRvj-3o2-5@gated-at.bofh.it> |
| In reply to | #223739 |
[Multipart message — attachments visible in raw view] — view raw
On Sat, Jun 20, 2020 at 10:48 <l0f4r0@tuta.io> wrote: > Hi, > ... > Actually, as explained on https://wiki.debian.org/nftables, Buster uses > an "iptables-nft layer (i.e, using iptables syntax with the nf_tables > kernel subsystem). This also affects ip6tables, arptables and ebtables." ... Oops, my bad. ... > You decide. iptables is being progressively superseded by nftables. > However, the former is still heavily used. > nftables is the future, that's why I've chosen it. ... I have no love for iptables and very little experience with it. So it seems I should remove the iptables package and install the nftables one. And I'll look into firewalld which I tried briefly some years ago. Thanks so much. Cheers! -Tom
[toc] | [prev] | [next] | [standalone]
| From | Andrei POPESCU <andreimpopescu@gmail.com> |
|---|---|
| Date | 2020-06-20 22:20 +0200 |
| Subject | Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? |
| Message-ID | <AjS81-3Qg-3@gated-at.bofh.it> |
| In reply to | #223758 |
[Multipart message — attachments visible in raw view] — view raw
On Sb, 20 iun 20, 14:37:34, Tom Browder wrote: > > I have no love for iptables and very little experience with it. So it seems > I should remove the iptables package and install the nftables one. And I'll > look into firewalld which I tried briefly some years ago. In case you are considering using nftables directly, you only need to install the 'nftables' package and put your rules in /etc/nftables.conf. There are some good examples on https://wiki.nftables.org that you can adapt for your needs. Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser
[toc] | [prev] | [next] | [standalone]
| From | Ben Lavender <ben@airnet.org.uk> |
|---|---|
| Date | 2020-06-20 19:50 +0200 |
| Subject | Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? |
| Message-ID | <AjPMR-2ke-1@gated-at.bofh.it> |
| In reply to | #223728 |
[Multipart message — attachments visible in raw view] — view raw
Personally I'd learn nf_tables because that's the way forward and if you stick to it's CLI then the better. I found this on github: https://github.com/larsbs/nftablui but i havn't used it myself so maybe it could be of use to you? Regards Ben Lavender On Sat, 20 Jun 2020, 15:25 Tom Browder, <tom.browder@gmail.com> wrote: > I see it's recommended that Buster users use nftables, but the default > installation still uses iptables! > > I need to change ports on my new remote server to allow http and https > traffic, but should I keep using iptables? Or should I remove iptables > and install nftables first? > > If I keep iptables, should I add a firewall management program like > ufw or something else? Is there something like ufw for nftables? > > Thanks. > > Best regards, > > -Tom > >
[toc] | [prev] | [next] | [standalone]
| From | Tom Browder <tom.browder@gmail.com> |
|---|---|
| Date | 2020-06-20 21:40 +0200 |
| Subject | Re: What is the best practice for a firewall for Debian Buster: iptables or nftables? |
| Message-ID | <AjRvj-3o2-9@gated-at.bofh.it> |
| In reply to | #223750 |
[Multipart message — attachments visible in raw view] — view raw
On Sat, Jun 20, 2020 at 12:44 Ben Lavender <ben@airnet.org.uk> wrote: > Personally I'd learn nf_tables because that's the way forward and if you > stick to it's CLI then the better. > Thanks, Ben. -Tom
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web