It's important to understand that while there are two variants of iptables, packet matching utilizes the same code. Note: The userspace command for nftables is nft. These benefits are mostly transparent to the user. Fast updates to the incremental ruleset.No file-based locking (for example: /run/xtables.lock).As a result, you get the following benefits while using the familiar iptables command: The iptables-nft command uses the newer nftables kernel API but reuses the legacy packet-matching code. The iptables-nft command allows iptables users to take advantage of the improvements. 1 root root 17 Mar 17 10:22 /usr/sbin/iptables -> xtables-nft-multiĪs I noted earlier, the nftables utility improves the kernel API. You can also identify iptables-nft by checking whether the iptables binary is a symbolic link to # ls -al /usr/sbin/iptables
For iptables-nft, the variant will be shown in parentheses after the version number, denoted as # iptables -Vįor iptables-legacy, the variant will either be absent, or it will show legacy in # iptables -V You can find out which variant is in use by looking up the iptables version. The newer iptables-nft command provides a bridge to the nftables kernel API and infrastructure. nf_tables: Often referred to as iptables-nft.legacy: Often referred to as iptables-legacy.The two variants of the iptables command are: You can use either the nft command or a variant of the iptables command to access the kernel API. The kernel API is how user space programs the kernel. The most important nftables improvement, in the context of this article, is the kernel API. It presented an opportunity to learn from the mistakes made with iptables and improve on them. It lived a good, long life in Linux history, but it wasn't without pain points. In the beginning, there was only iptables. In this article, I attempt to clarify the relationship between the two variants of iptables and its successor program, nftables. The association between the two utilities is subtle, which has led to confusion among Linux users and developers. In Red Hat Enterprise Linux (RHEL) 8, the userspace utility program iptables has a close relationship to its successor, nftables.
0 kommentar(er)
