The release of the classic toolkit for managing the iptables packet filter 1.8.10 has been published, with recent developments focusing on components for maintaining backward compatibility — iptables-nft and ebtables-nft, which provide utilities with the same command-line syntax as iptables and ebtables, but translating the received rules into nftables bytecode. The original suite of programs, including ip6tables, arptables, and ebtables, was deprecated in 2018 and has since been replaced by nftables in most distributions.
In the new version:
- Support for insert rules, which specify the index number (converted to ntf rules ‘insert rule … index N’), has been added to the xtables-translate utility.
- Support for broute (bridge route) tables has been added to ebtables-nft.
- The debug output of the nft-variants utility, enabled by specifying the option ‘-v’ multiple times, now displays available set collections.
- Support for the names ‘mld-listener-query’, ‘mld-listener-report’, and ‘mld-listener-done’ has been added for addressing ICMPv6 messages with types 130, 131, and 132.
- The correct parsing of ‘meta mark’ expressions and their conversion to ‘-j MARK’ rules has been ensured, which may be necessary for mixing nftables and iptables-nft in a single table.
- Accumulated bugs have been fixed.
Source: opennet.ru
