Supported features compared to xtables: Difference between revisions
Jump to navigation
Jump to search
(Review the list, update details, add links to xlate-test cases for samples) |
(linked to my ad-hoc script updating the xlate sample links) |
||
| (One intermediate revision by the same user not shown) | |||
| Line 54: | Line 54: | ||
== Supported extensions == | == Supported extensions == | ||
(Links updated via [http://nwl.cc/~n0-1/update_nftables_wiki_xlate_links.sh script].) | |||
=== matches: xt === | === matches: xt === | ||
| Line 160: | Line 161: | ||
==== socket ==== | ==== socket ==== | ||
* consider native interface | * consider native interface | ||
* [https://git.netfilter.org/iptables/tree/extensions/libxt_socket.txlate Examples from iptables-translate testsuite] | |||
==== statistic ==== | ==== statistic ==== | ||
* nft_numgen. Refer to [[Load balancing]]. | * nft_numgen. Refer to [[Load balancing]]. | ||
| Line 172: | Line 174: | ||
==== tcpmss ==== | ==== tcpmss ==== | ||
* nft_exthdr, since 4.14 | * nft_exthdr, since 4.14 | ||
* [https://git.netfilter.org/iptables/tree/extensions/libxt_tcpmss.txlate Examples from iptables-translate testsuite] | |||
==== time ==== | ==== time ==== | ||
| Line 224: | Line 227: | ||
==== TPROXY ==== | ==== TPROXY ==== | ||
* nft_tproxy, since 4.19 | * nft_tproxy, since 4.19 | ||
* [https://git.netfilter.org/iptables/tree/extensions/libxt_TPROXY.txlate Examples from iptables-translate testsuite] | |||
==== TRACE ==== | ==== TRACE ==== | ||
| Line 231: | Line 235: | ||
==== TCPMSS ==== | ==== TCPMSS ==== | ||
* nft_exthdr, since 4.14 | * nft_exthdr, since 4.14 | ||
* [https://git.netfilter.org/iptables/tree/extensions/libxt_TCPMSS.txlate Examples from iptables-translate testsuite] | |||
=== matches: ipv4 === | === matches: ipv4 === | ||
Latest revision as of 12:38, 14 September 2024
Last update: Mar/2022
This page tracks the list of supported and unsupported extensions with comments and suggestions.
Unsupported extensions
matches: xt
bpf
- consider native interface
rateest
- consider native interface
string
- consider native interface
u32
- raw expressions?
targets: xt
CHECKSUM
- add nft_payload.
- To the day, the only use case for this was DHCP clients not working with partial checksums. That should be fixed nowadays.
- See https://lwn.net/Articles/396466/ and https://www.spinics.net/lists/kvm/msg37660.html
- See https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/930962 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832090
CT
- nft_ct_target. Refer to Matching_connection_tracking_stateful_metainformation.
IDLETIMER
- consider native interface
LED
- consider native (need this?)
RATEEST
- consider native interface
TCPOPTSTRIP
- consider native interface, need to extend nft_exthdr.c
targets: ipv4
TTL
targets: ipv6
NPT
- consider native interface
targets: bridge
arpreply
- consider native interface
targets: arp
TODO
Supported extensions
(Links updated via script.)
matches: xt
addrtype
- nft_fib, starting with 4.10 kernel. Refer to Matching routing information.
- Examples from iptables-translate testsuite
cgroup
- nft_meta. Refer to Quick_reference-nftables_in_10_minutes#Meta.
- Examples from iptables-translate testsuite
[Awaits support for cgroup2]
cluster
comment
- Built-in support via NFTA_RULE_USERDATA, since 3.15 (Pablo Neira). Refer to matching UDP/TCP headers in the same rule.
- Examples from iptables-translate testsuite
connbytes
- nft_ct, 4.5 kernel. Refer to Meters.
- Examples from iptables-translate testsuite
connlabel
- nft_meta, since 3.16.
- Examples from iptables-translate testsuite
connlimit
- consider native interface. Refer to Meters.
- Examples from iptables-translate testsuite
connmark
conntrack
cpu
- nft_meta, since 3.18.
- Examples from iptables-translate testsuite
dccp
- nft_payload.
- Examples from iptables-translate testsuite
[Unsupported option : dccp-option]
devgroup
- nft_meta, since 3.18.
- Examples from iptables-translate testsuite
dscp
- nft_payload.
- Examples from iptables-translate testsuite
ecn
- nft_payload.
- Examples from iptables-translate testsuite
esp
- nft_payload.
- Examples from iptables-translate testsuite
hashlimit
- meter statement. Refer to Meters.
- Examples from iptables-translate testsuite
helper
ipcomp
- nft_payload.
- Examples from iptables-translate testsuite
[Unsupported option : compres]
iprange
- nft_payload, through native range support. To emulate iptables --ports you need two rules.
- Examples from iptables-translate testsuite
ipvs
- consider native interface. Refer to Load balancing.
length
limit
- nft_limit. Refer to Stateful objects.
- Examples from iptables-translate testsuite
mac
- nft_payload.
- Examples from iptables-translate testsuite
mark
multiport
- nft_payload.
- Examples from iptables-translate testsuite
nfacct
- consider native interface. Refer to Stateful objects.
osf
- consider native interface
owner
[Unsupported option : socket-exists]
pkttype
policy
- nft_xfrm, since 5.0
- Examples from iptables-translate testsuite
recent
- consider native interface. Refer to Sets.
sctp
- nft_payload
- nft_exthdr for --chunk-types
- Examples from iptables-translate testsuite
socket
- consider native interface
- Examples from iptables-translate testsuite
statistic
- nft_numgen. Refer to Load balancing.
- Examples from iptables-translate testsuite
set
- Use native nf_tables set infrastructure.
state
- nft_ct
tcp
- nft_payload
- Examples from iptables-translate testsuite
tcpmss
- nft_exthdr, since 4.14
- Examples from iptables-translate testsuite
time
- nft_meta, since 5.4
- Examples from iptables-translate testsuite
udp
- nft_payload
- Examples from iptables-translate testsuite
targets: xt
AUDIT
- nft_log, since 4.18.
- Examples from iptables-translate testsuite
CLASSIFY
- nft_meta, since 3.14.
- Examples from iptables-translate testsuite
CONNMARK
CONNSECMARK
- nft_ct, since 4.20
DSCP
- nft_payload
- Examples from iptables-translate testsuite
HL
- nft_payload
HMARK
- nft_meta + nft_hash.
MARK
- nft_meta, since 3.14.
- Examples from iptables-translate testsuite
NETMAP
- nft_nat, upcoming 5.8
NFLOG
- nft_log, since 3.17.
- Examples from iptables-translate testsuite
NFQUEUE
- nft_queue, since 3.14.
- Examples from iptables-translate testsuite
SECMARK
- nft_meta, since 4.20
SYNPROXY
- nft_synproxy, since 5.3
- Examples from iptables-translate testsuite
TEE
- nft_dup, since 4.3.
- Examples from iptables-translate testsuite
TPROXY
- nft_tproxy, since 4.19
- Examples from iptables-translate testsuite
TRACE
- nft_meta, since 3.14.
- Examples from iptables-translate testsuite
TCPMSS
- nft_exthdr, since 4.14
- Examples from iptables-translate testsuite
matches: ipv4
ah
- nft_payload + nft_cmp
- Examples from iptables-translate testsuite
icmp
- nft_payload + nft_cmp.
- Examples from iptables-translate testsuite
[Unsupported codes: network-unreachable, host-unreachable, protocol-unreachable, port-unreachable, fragmentation-needed, source-route-failed, network-unknown, host-unknown, network-prohibited, host-prohibited, TOS-network-unreachable, TOS-host-unreachable, communication-prohibited, host-precedence-violation, precedence-cutoff, network-redirect, host-redirect, TOS-network-redirect, TOS-host-redirect, ttl-zero-during-transit, ttl-zero-during-reassembly, ip-header-bad and required-option-missing ]
realm
- nft_meta, through NFT_META_RTCLASSID.
- Examples from iptables-translate testsuite
rp_filter
- nft_fib, starting with 4.10 kernel
ttl
- nft_payload
- Examples from iptables-translate testsuite
matches: ipv6
rp_filter
- nft_fib, starting with 4.10 kernel
ah
- nft_payload + nft_cmp.
- Examples from iptables-translate testsuite
eui64
- nft_payload + nft_cmp.
frag
- nft_exthdr + nft_cmp.
- Examples from iptables-translate testsuite
hbh
- nft_exthdr + nft_cmp.
- Examples from iptables-translate testsuite
HBH options are not supported yet. [Unsupported option: --hbh-opts]
hl
- nft_payload.
- Examples from iptables-translate testsuite
icmp6
- nft_payload + nft_cmp.
- Examples from iptables-translate testsuite
[Unsupported icmpv6 codes: no-route, communication-prohibited, beyond-scope, address-unreachable, port-unreachable, failed-policy, reject-route, ttl-zero-during-transit, ttl-zero-during-reassembly, bad-header, unknown-header-type and unknown-option]
ipv6header
- nft_exthdr + nft_cmp.
mh
- nft_exthdr + nft_cmp.
- Examples from iptables-translate testsuite
[Needs bug fixation for option mh-type with range]
rt
- nft_exthdr + nft_cmp
- Examples from iptables-translate testsuite
[Unsupported options: --rt-0-res, --rt-0-addrs, --rt-0-not-strict]
targets: ipv4
ECN
- nft_payload
DNAT
- nft_nat, since 3.13.
- Examples from iptables-translate testsuite
LOG
- nft_log, since 3.17.
- Examples from iptables-translate testsuite
[Unsupported options : log-tcp-sequence, log-tcp-options, log-ip-options, log-uid, log-macdecode]
MASQUERADE
- nft_masq, since 3.18.
- Examples from iptables-translate testsuite
REDIRECT
- nft_redirect, since 3.19.
- Examples from iptables-translate testsuite
REJECT
- nft_reject_ipv4, since 3.13.
- nft_reject_inet, since 3.14.
- nft_reject_bridge, since 3.18.
- Examples from iptables-translate testsuite
SNAT
- nft_nat, since 3.13.
- Examples from iptables-translate testsuite
targets: ipv6
DNAT
- nft_nat, since 3.13.
- Examples from iptables-translate testsuite
LOG
- nft_log, since 3.17.
- Examples from iptables-translate testsuite
[Unsupported options : log-tcp-sequence, log-tcp-options, log-ip-options, log-uid, log-macdecode]
MASQUERADE
- nft_masq, since 3.18.
- Examples from iptables-translate testsuite
REDIRECT
- nft_redirect, since 3.19.
- Examples from iptables-translate testsuite
REJECT
- nft_reject_ipv6, since 3.14.
- nft_reject_inet, since 3.14.
- nft_reject_bridge, since 3.18.
- Examples from iptables-translate testsuite
SNAT
- nft_nat, since 3.13.
- Examples from iptables-translate testsuite
matches: bridge
802.3
- nft_payload
among
- sets
arp
- nft_payload
ip
- nft_payload
- Examples from iptables-translate testsuite
ip6
- nft_payload
- Examples from iptables-translate testsuite
limit
mark
pkttype
stp
- nft_payload
vlan
- nft_payload
- Examples from iptables-translate testsuite
targets: bridge
dnat
- nft_payload
- Examples from iptables-translate testsuite
snat
- nft_payload
- Examples from iptables-translate testsuite
redirect
- nft_payload + nft_meta (pkttype set unicast)
mark
watchers: bridge
log
nflog
Deprecated extensions
matches
physdev
- br_netfilter aims to be deprecated by nftables.
quota
- nfacct already provides quota support.
tos
- deprecated by dscp
targets
CLUSTERIP
- deprecated by cluster match.
TOS
- deprecated by DSCP
targets: ipv4
ULOG
- Removed from tree since 3.17.