Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #224809

Re: Network services fail on startup

Show all headers | View raw

Andrei POPESCU wrote: 
> On Ma, 14 iul 20, 07:11:39, Dan Ritter wrote:
> > The way to handle a giant blocklist efficiently is ipset, which manipulates
> > large groups of IPs that will be matched for a particular rule.
> 
> Disclaimer: I'm not an expert on either iptables or nftables, this is 
> just based on some documentation I read.
> 
> As far as I understand, while iptables (in buster) is indeed a frontend 
> to nftables, nftables has new features that are not usable with iptables 
> syntax.
> https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

> In particular regarding ipset, this page suggests manual translation is 
> necessary:
> 
> https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_ipset_to_nftables


You are correct in all regards, but you are also not taking the
next, necessary step.

A firewall which is currently using iptables can be rewritten to
use iptables and ipset; or it can be rewritten to use nftables
with ipset. In either case, ipset is the correct tool, it just
changes syntax in between versions, so to avoid duplicating
effort, one might prefer to make one conversion rather than two.

-dsr-

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Network services fail on startup Ross Boylan <rossboylan@stanfordalumni.org> - 2020-07-14 03:50 +0200
  Re: Network services fail on startup Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-14 08:50 +0200
  Re: Network services fail on startup Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-14 08:50 +0200
    Re: Network services fail on startup Dan Ritter <dsr@randomstring.org> - 2020-07-14 13:20 +0200
      Re: Network services fail on startup Andrei POPESCU <andreimpopescu@gmail.com> - 2020-07-14 19:10 +0200
        Re: Network services fail on startup Dan Ritter <dsr@randomstring.org> - 2020-07-14 19:30 +0200
  Re: Network services fail on startup deloptes <deloptes@gmail.com> - 2020-07-14 09:40 +0200
  Re: Network services fail on startup Greg Wooledge <wooledg@eeg.ccf.org> - 2020-07-14 13:40 +0200
    Re: Network services fail on startup Ross Boylan <rossboylan@stanfordalumni.org> - 2020-07-15 00:30 +0200
      Re: Network services fail on startup Ross Boylan <rossboylan@stanfordalumni.org> - 2020-07-16 02:40 +0200

csiph-web