After a year of development, the classic toolkit for managing the iptables packet filter has been released in version 1.8.11, with recent development focused on components to maintain backward compatibility — iptables-nft and ebtables-nft, which provide utilities with the same command line syntax as iptables and ebtables, but translate the resulting rules into nftables bytecode. The original set of iptables programs, including ip6tables, arptables, and ebtables, was deprecated in 2018 and has already been replaced by nftables in most distributions.
In the new version:
- Added a new utility arptables-translate, designed to translate arptables rules into a configuration format for use with nftables.
- The ebtables-nft utility now supports the "--change-counters", "--replace", and "--list-rules" commands. It is now possible to specify counters for rules using the "-c N,M" syntax. It is now possible to reset individual rules.
- The iptables-translate utility now supports TPROXY targets and the xt_socket extension for socket matching. Protocol name definition is now unified with iptables.
- The iptables utility has been enabled to implicitly look for extensions for the dccp and ipcomp protocols to achieve uniform behavior with iptables-save.
- The iptables-save utility has removed getprotobynumber() calls to improve performance when processing large rulesets.
- The configure script now has the ability to disable assembly with libnfnetlink.
Source: opennet.ru
