Supported features compared to xtables - Revision history

Fw: TCPOPTSTRIP is supported via nft_exthdr since 2022.

2025-07-14T14:49:18Z

TCPOPTSTRIP is supported via nft_exthdr since 2022.

← Older revision		Revision as of 14:49, 14 July 2025
Line 233:		Line 233:
	* nft_exthdr, since 4.14		* nft_exthdr, since 4.14
	* [https://git.netfilter.org/iptables/tree/extensions/libxt_TCPMSS.txlate Examples from iptables-translate testsuite]		* [https://git.netfilter.org/iptables/tree/extensions/libxt_TCPMSS.txlate Examples from iptables-translate testsuite]

			==== TCPOPTSTRIP ====
			* nft_exthdr, since 5.18

	=== matches: ipv4 ===		=== matches: ipv4 ===

2025-07-14T14:47:20Z

tcpoptstrip is supported since 2022, remove from unsupported list.

← Older revision		Revision as of 14:47, 14 July 2025
Line 32:		Line 32:
	==== RATEEST ====		==== RATEEST ====
	* consider native interface		* consider native interface
	~~==== TCPOPTSTRIP ====~~
	* consider native interface, need to extend nft_exthdr.c

	=== targets: ipv4 ===		=== targets: ipv4 ===

2024-09-14T10:38:50Z

linked to my ad-hoc script updating the xlate sample links

← Older revision		Revision as of 10:38, 14 September 2024
Line 54:		Line 54:

	== Supported extensions ==		== Supported extensions ==
			(Links updated via [http://nwl.cc/~n0-1/update_nftables_wiki_xlate_links.sh script].)

	=== matches: xt ===		=== matches: xt ===

2024-09-13T13:07:03Z

Supported extensions: Updated with links to new xlate test cases

← Older revision		Revision as of 13:07, 13 September 2024
Line 160:		Line 160:
	==== socket ====		==== socket ====
	* consider native interface		* consider native interface
			* [https://git.netfilter.org/iptables/tree/extensions/libxt_socket.txlate Examples from iptables-translate testsuite]
	==== statistic ====		==== statistic ====
	* nft_numgen. Refer to [[Load balancing]].		* nft_numgen. Refer to [[Load balancing]].
Line 172:		Line 173:
	==== tcpmss ====		==== tcpmss ====
	* nft_exthdr, since 4.14		* nft_exthdr, since 4.14
			* [https://git.netfilter.org/iptables/tree/extensions/libxt_tcpmss.txlate Examples from iptables-translate testsuite]

	==== time ====		==== time ====
Line 224:		Line 226:
	==== TPROXY ====		==== TPROXY ====
	* nft_tproxy, since 4.19		* nft_tproxy, since 4.19
			* [https://git.netfilter.org/iptables/tree/extensions/libxt_TPROXY.txlate Examples from iptables-translate testsuite]

	==== TRACE ====		==== TRACE ====
Line 231:		Line 234:
	==== TCPMSS ====		==== TCPMSS ====
	* nft_exthdr, since 4.14		* nft_exthdr, since 4.14
			* [https://git.netfilter.org/iptables/tree/extensions/libxt_TCPMSS.txlate Examples from iptables-translate testsuite]

	=== matches: ipv4 ===		=== matches: ipv4 ===

2022-03-11T17:34:00Z

Review the list, update details, add links to xlate-test cases for samples

2022-03-10T17:40:13Z

Link to iptables-translate testsuite for examples, libebt_log.txlate only for now

← Older revision		Revision as of 17:40, 10 March 2022
Line 55:		Line 55:
	==== log ====		==== log ====
	* nft_log		* nft_log
			* [https://git.netfilter.org/iptables/tree/extensions/libebt_log.txlate Examples from iptables-translate testsuite]

	==== nflog ====		==== nflog ====

2021-05-21T14:15:28Z

chunk-types match is supported now

← Older revision		Revision as of 14:15, 21 May 2021
Line 135:		Line 135:
	* consider native interface. Refer to [[Sets]].		* consider native interface. Refer to [[Sets]].
	==== sctp ====		==== sctp ====
	* nft_payload.		* nft_payload
	~~[Unsupported option:~~ --chunk-types]		* nft_exthdr for --chunk-types
	==== socket ====		==== socket ====
	* consider native interface		* consider native interface

2021-04-16T22:26:35Z

addrtype: Updated link to matching routing information.

← Older revision		Revision as of 22:26, 16 April 2021
Line 68:		Line 68:

	==== addrtype ====		==== addrtype ====
	* nft_fib, starting with 4.10 kernel. Refer to [[~~Routing_information~~]].		* nft_fib, starting with 4.10 kernel. Refer to [[Matching routing information]].

	==== cgroup ====		==== cgroup ====
	* nft_meta. Refer to [[Quick_reference-nftables_in_10_minutes#Meta]].		* nft_meta. Refer to [[Quick_reference-nftables_in_10_minutes#Meta]].

2021-04-16T20:32:28Z

comment: Updated link to matching UDP/TCP headers in the same rule.

← Older revision		Revision as of 20:32, 16 April 2021
Line 73:		Line 73:
	[Awaits support for cgroup2]		[Awaits support for cgroup2]
	==== comment ====		==== comment ====
	* Built-in support via NFTA_RULE_USERDATA, since 3.15 (Pablo Neira). Refer to [[~~Matching_packet_header_fields~~#Matching_UDP.2FTCP_headers_in_the_same_rule]].		* Built-in support via NFTA_RULE_USERDATA, since 3.15 (Pablo Neira). Refer to [[Matching_packet_headers#Matching_UDP.2FTCP_headers_in_the_same_rule\|matching UDP/TCP headers in the same rule]].

	==== connbytes ====		==== connbytes ====
	* nft_ct, 4.5 kernel. Refer to [[Meters]].		* nft_ct, 4.5 kernel. Refer to [[Meters]].

2020-06-17T16:43:30Z

NETMAP is now supported