Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227851 > unrolled thread

Stretch => Buster: iptables

Back to article view | Back to linux.debian.user

Contents

  Stretch => Buster: iptables Jesper Dybdal <jd-debian-user@dybdal.dk> - 2020-10-16 12:30 +0200
    Re: Stretch => Buster: iptables Reco <recoverym4n@enotuniq.net> - 2020-10-16 12:40 +0200
      Re: Stretch => Buster: iptables Jesper Dybdal <jd-debian-user@dybdal.dk> - 2020-10-16 14:20 +0200
        Re: Stretch => Buster: iptables Pierre-Elliott Bécue <peb@debian.org> - 2020-10-16 16:30 +0200
    Re: Stretch => Buster: iptables Jesper Dybdal <jd-debian-user@dybdal.dk> - 2020-11-06 10:50 +0100
      Re: Stretch => Buster: iptables Sven Hartge <sven@svenhartge.de> - 2020-11-06 11:50 +0100
        Re: Stretch => Buster: iptables Jesper Dybdal <jd-debian-user@dybdal.dk> - 2020-11-06 12:10 +0100

#227851 — Stretch => Buster: iptables

I have a lot of iptables rules.

Is it correctly understood that the upgrade to Buster will automatically 
install iptables-nft, and that iptablés-nft provides complete and 
compatible support for the functionality of the old iptables command, so 
I can expect my iptables scripts to just work?

(If so, that would be really nice, since I can then postpone the move to 
native nftables.)

Thanks,
Jesper

-- 
Jesper Dybdal
https://www.dybdal.dk

[toc] | [next] | [standalone]

#227856

	Hi.

On Fri, Oct 16, 2020 at 12:25:23PM +0200, Jesper Dybdal wrote:
> I have a lot of iptables rules.
> 
> Is it correctly understood that the upgrade to Buster will automatically install iptables-nft, and that iptablés-nft provides complete and compatible support
> for the functionality of the old iptables command, so I can expect my iptables scripts to just work?

Barring some kernel bugs - yes.
For instance, I've seen kernel panics because of simple:

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

It *should* be fixed by now, but I cannot call my own usage of netfilter
that advanced (filter, nat, *some* raw, that's it).


> (If so, that would be really nice, since I can then postpone the move to native nftables.)

To switch back to conventional netfilter you'll have to execute these:

update-alternatives --config iptables
update-alternatives --config ip6tables
update-alternatives --config arptables
update-alternatives --config ebtables

Last two are optional, and it all should be done after the migration to buster.

Reco

[toc] | [prev] | [next] | [standalone]

#227862

On 2020-10-16 12:35, Reco wrote:
> Barring some kernel bugs - yes.
> For instance, I've seen kernel panics because of simple:
>
> iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

Aargh!   I had not realized that I would have to be prepared for kernel 
panics during the upgrade, so I really appreciate that warning.  I'll 
have a bootable rescue disk ready.

Thanks a lot for not only this, but also your responses to my other 
questions.

-- 
Jesper Dybdal
https://www.dybdal.dk

[toc] | [prev] | [next] | [standalone]

#227868

[Multipart message — attachments visible in raw view] — view raw

Le vendredi 16 octobre 2020 à 14:12:55+0200, Jesper Dybdal a écrit :
> 
> On 2020-10-16 12:35, Reco wrote:
> > Barring some kernel bugs - yes.
> > For instance, I've seen kernel panics because of simple:
> > 
> > iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
> 
> Aargh!   I had not realized that I would have to be prepared for kernel
> panics during the upgrade, so I really appreciate that warning.  I'll have a
> bootable rescue disk ready.
> 
> Thanks a lot for not only this, but also your responses to my other
> questions.

Don't worry too much on that KP part, it's true there were some
instabilities at first, but not in the stable release.

For what it's worth, there are also scripts helping to transition to
nftables for good.

Cheers,

-- 
Pierre-Elliott Bécue
GPG: 9AE0 4D98 6400 E3B6 7528  F493 0D44 2664 1949 74E2
It's far easier to fight for one's principles than to live up to them.

[toc] | [prev] | [next] | [standalone]

#228499

On 2020-10-16 12:25, I wrote:
> I have a lot of iptables rules.
>
> Is it correctly understood that the upgrade to Buster will 
> automatically install iptables-nft, and that iptablés-nft provides 
> complete and compatible support for the functionality of the old 
> iptables command, so I can expect my iptables scripts to just work?
>
I have now upgraded the first of my Stretch machines, and iptables-nft 
works, but does not support everything.

I can recommend studying
https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables
before upgrading to Buster if the system has non-trivial iptables usage.

In my case, I was using the following that is not supported by iptables-nft:
* The "recent" module.  But I can do without that.
* The "tos" module.  But I can do without that.
* The CT target, to add the ftp helper.  I fixed that by adding a bit of 
native nft with the nft command after all the iptables(-nft) commands.

-- 
Jesper Dybdal
https://www.dybdal.dk

[toc] | [prev] | [next] | [standalone]

#228501

Jesper Dybdal <jd-debian-user@dybdal.dk> wrote:

> * The CT target, to add the ftp helper.  I fixed that by adding a bit of 
> native nft with the nft command after all the iptables(-nft) commands.

For the sake of the archive and people looking at this thread hoping for
some insight, please post your native nft rules you created.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#228502

[Multipart message — attachments visible in raw view] — view raw

On 2020-11-06 11:43, Sven Hartge wrote:
> Jesper Dybdal <jd-debian-user@dybdal.dk> wrote:
>> * The CT target, to add the ftp helper.  I fixed that by adding a bit of
>> native nft with the nft command after all the iptables(-nft) commands.
> For the sake of the archive and people looking at this thread hoping for
> some insight, please post your native nft rules you created.

Here they are (I'm afraid I can't remember which websites I got the 
inspiration from):

table ip myhelpers {
         ct helper ftp-standard {
                 type "ftp" protocol tcp
         }
     chain input {
                 type filter hook prerouting priority 0;
                 tcp dport 21 ct helper set "ftp-standard" counter
         }
     chain output {
                 type filter hook output priority 0;
                 tcp dport 21 ct helper set "ftp-standard" counter
         }
}


I loaded them after all the iptables-nft rules with the commands:

# Delete any existing myhelpers tables, ignoring possible failure for an 
non-existent table:
nft delete table myhelpers >/dev/null 2>&1
# Load the myhelpers table shown above:
nft -f myhelpers.nft

This seems to work.

-- 
Jesper Dybdal
https://www.dybdal.dk

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web