Following and Ubuntu developers default transition to using the packet filter .
To maintain backward compatibility, it is recommended to use the package , which provides utilities with the same command line syntax as iptables, but translates the received rules into bytecode for nf_tables. This change is expected to be included in the autumn release of Ubuntu 20.10.
This is the second attempt to transition Ubuntu to nftables. The first attempt was made last year, but was rejected due to incompatibility with the tooling . Now in LXD there is already built-in support for nftables, and it can work with the new backend for packet filtering. For users who require more than just a compatibility layer, there is an option to install the classic utilities iptables, ip6tables, arptables, and ebtables with the old backend.
Let’s remember that in the packet filter the interfaces for packet filtering for IPv4, IPv6, ARP, and network bridges are unified. The nftables package includes user-space packet filter components, while at the kernel level, the nf_tables subsystem, which has been part of the Linux kernel since version 3.13, performs the work. At the kernel level, only a generic interface is provided, independent of the specific protocol, offering basic functions for extracting data from packets, performing data operations, and managing flow.
Directly, the filtering rules and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special virtual machine similar to BPF (Berkeley Packet Filters). This approach allows for a significant reduction in the size of the filtering code running at the kernel level and shifts all parsing rule functions and protocol operational logic to user space.
Source: opennet.ru
