Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
linux_router:iptables [2020-04-24 Fri wk17 21:55] – [Additional IPTables setup requirements] baumkplinux_router:iptables [2024-12-15 Sun wk50 10:31] (current) – [IPTables Configuration] baumkp
Line 1: Line 1:
 {{tag>linux router firewall IPTables}} {{tag>linux router firewall IPTables}}
 =====IPTables Configuration===== =====IPTables Configuration=====
 +Having delved into IPtables and NFtables about the same time, my feelings are that NFTables is generally superior in just about every way,  I can not be bothered explaining this, this is just my experience and feeling.  I would preferentially use NFTables over IPtables where I have a choice.  Unfortunately some software still uses IPtables, e.g. Docker.  So it is good to be able to be sufficiently fluent and be able to work in both at this time.
  
 +++++tl;dr;|
 I went down the route of attempting to configure the firewall using NFtables. NFTables has some nice features that look to make it more user friendly than IPTables. On larger, more complex installs NFTables looks to have some significant technical advantages over IPTables, but these benefits are probably less significant on my smaller undertaking. That being said for those already familiar with IPTables this will not be the case. I went down the route of attempting to configure the firewall using NFtables. NFTables has some nice features that look to make it more user friendly than IPTables. On larger, more complex installs NFTables looks to have some significant technical advantages over IPTables, but these benefits are probably less significant on my smaller undertaking. That being said for those already familiar with IPTables this will not be the case.
  
 As of year ending 2019 general support and functionality of NFTables is much improved.  That being said overall information and support for IPTables is more comprehensive.  Application packages such as Docker and Fail2ban basically still have default enbedment of IPTables with use of NFTables required greater care and effort.  As of year ending 2019 general support and functionality of NFTables is much improved.  That being said overall information and support for IPTables is more comprehensive.  Application packages such as Docker and Fail2ban basically still have default enbedment of IPTables with use of NFTables required greater care and effort. 
  
-<fs smaller>Unfortunately the package version supplied with Ubuntu 16.04 was released in 2015-11, and during my configuration I found some bugs. Also mss clamping is not supported in this version. I tried the Ubuntu 18.04 development version and the previous noted bugs were no longer apparent and mss clamping was supported.</fs> +<fs smaller>Unfortunately the package version supplied with Ubuntu 16.04 was released in 2015-11, and during my configuration I found some bugs. Also mss clamping is not supported in this version. I tried the Ubuntu 18.04 development version and the previous noted bugs were no longer apparent and mss clamping was supported.</fs>  
 +++++
 **//I have not cross checked this IPTable version against the working NFTables version, and it is definitely out of alignment and untested.//** **//I have not cross checked this IPTable version against the working NFTables version, and it is definitely out of alignment and untested.//**