The release of the classic toolkit for managing the iptables packet filter 1.8.8 has been published, with recent development focused on components for maintaining backward compatibility—iptables-nft and ebtables-nft—providing utilities with the same command line syntax as iptables and ebtables, but translating the received rules into nf_tables bytecode. The original iptables suite, including ip6tables, arptables, and ebtables, was transitioned to obsolete status in 2018 and has already been replaced by nftables in most distributions.
In the new version:
- Support for `connlimit` and `tcpmss` expressions has been added to the iptables-translate utility, which translates iptables rules into nftables rule sets. For `sctp` and `multiport` blocks, the use of `--chunk-types` and `--ports` options has been implemented.
- The translation of `conntrack` blocks and the `--tcp-flags` options into nftables rules has been simplified.
- In libxtables, operation is prohibited when called from executables with the setuid flag.
- The removal of built-in chains is now permitted in the iptables-nft utility.
- A rule parser from the arptables-nft utility has been added to iptables-nft.
- The arptables-nft utility has added support for the `-C` and `-S` commands, implemented rule indexing for the `-I` and `-R` commands, and introduced support for counter syntax `-c N,M`.
- Support for specifying multiple IPv4 address ranges at once has been discontinued in the *NAT tables.
- The ability to enable debug output in iptables-restore, iptables-nft, and ebtables-nft through repeated specification of the `-v` option has been implemented.
- The performance of the iptables-save and iptables-restore utilities has been improved.
Source: opennet.ru
