Arturo Borrero Gonzalez
2018-11-23 09:30:01 UTC
Package: release-notes
Severity: normal
Tags: buster
Hi,
I think the iptables/nftables situation for Buster worth mentioning in the release
notes. We got some important changes that I will describe below:
=== 8< ===
Debian Buster uses now the nftables framework by default.
Starting with iptables v1.8.2 the binary package includes iptables-nft and
iptables-legacy, two variants of the iptables command line interface. The
nftables-based is the default in Debian Buster and works with the nf_tables
Linux kernel subsystem. The legacy one uses the x_tables Linux kernel
subsystem. Users can use the update-alternatives system to select one variant
or the other.
This applies to all related tools and utilities:
* iptables
* iptables-save
* iptables-restore
* ip6tables
* ip6tables-save
* ip6tables-restore
* arptables
* arptables-save
* arptables-restore
* ebtables
* ebtables-save
* ebtables-restore
All these gained the -nft and -legacy variants as well. The -nft option is for
users that don't want -or can't- migrate to the native nftables command line
interface.
However users are really enouraged to switch to nftables rather than using the
old iptables interface.
nftables provides a full replacement for iptables, with much better
performance, a refreshed syntax, better support for IPv4/IPv6 dual-stack
firewalls, full atomic operations for dynamic ruleset updates, a Netlink API
for third party applications, faster packet classification through enhanced
generic set and map infrastructures, and many other improvements [0].
This movement is in line with what other major Linux distributions are doing,
like the RedHat, that now uses nftables as default firewalling tool [1].
Also, please note that all iptables binaries are now installed in /usr/sbin
instead of /sbin. A compatibility symlink is in place, but will be dropped
after the Buster release cycle. Please, don't use hardcoded binary paths in
your scripts or update them manually for the new location.
Extensive documentation are available in package's README and NEWS files, and
also online [2].
[0] https://wiki.nftables.org
[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8-beta/html-single/8.0_beta_release_notes/index#networking_2
[2] https://wiki.debian.org/nftables
=== 8< ===
Severity: normal
Tags: buster
Hi,
I think the iptables/nftables situation for Buster worth mentioning in the release
notes. We got some important changes that I will describe below:
=== 8< ===
Debian Buster uses now the nftables framework by default.
Starting with iptables v1.8.2 the binary package includes iptables-nft and
iptables-legacy, two variants of the iptables command line interface. The
nftables-based is the default in Debian Buster and works with the nf_tables
Linux kernel subsystem. The legacy one uses the x_tables Linux kernel
subsystem. Users can use the update-alternatives system to select one variant
or the other.
This applies to all related tools and utilities:
* iptables
* iptables-save
* iptables-restore
* ip6tables
* ip6tables-save
* ip6tables-restore
* arptables
* arptables-save
* arptables-restore
* ebtables
* ebtables-save
* ebtables-restore
All these gained the -nft and -legacy variants as well. The -nft option is for
users that don't want -or can't- migrate to the native nftables command line
interface.
However users are really enouraged to switch to nftables rather than using the
old iptables interface.
nftables provides a full replacement for iptables, with much better
performance, a refreshed syntax, better support for IPv4/IPv6 dual-stack
firewalls, full atomic operations for dynamic ruleset updates, a Netlink API
for third party applications, faster packet classification through enhanced
generic set and map infrastructures, and many other improvements [0].
This movement is in line with what other major Linux distributions are doing,
like the RedHat, that now uses nftables as default firewalling tool [1].
Also, please note that all iptables binaries are now installed in /usr/sbin
instead of /sbin. A compatibility symlink is in place, but will be dropped
after the Buster release cycle. Please, don't use hardcoded binary paths in
your scripts or update them manually for the new location.
Extensive documentation are available in package's README and NEWS files, and
also online [2].
[0] https://wiki.nftables.org
[1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8-beta/html-single/8.0_beta_release_notes/index#networking_2
[2] https://wiki.debian.org/nftables
=== 8< ===