{"id":104040,"date":"2022-05-14T09:36:49","date_gmt":"2022-05-14T07:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-iptables-1-8-8"},"modified":"2022-05-14T09:36:49","modified_gmt":"2022-05-14T07:36:49","slug":"vypusk-paketnogo-filtra-iptables-1-8-8","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-iptables-1-8-8","title":{"rendered":"Release of the iptables 1.8.8 packet filter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of the classic toolkit for managing the packet filter iptables 1.8.8 has been published, the development of which has recently focused on components for maintaining backward compatibility \u2014 iptables-nft and ebtables-nft, which provide utilities with the same command line syntax as iptables and ebtables, but translate the received rules into the nf_tables bytecode. The original set of programs iptables, including ip6tables, arptables, and ebtables, was deprecated in 2018 and is now replaced by nftables in most distributions. <\/p>\n
In the new version: <\/p>\n
\n
The iptables-translate utility, which transforms iptables rules into nftables rule sets, has been updated to support the connlimit and tcpmss expressions, and for sctp and multiport blocks, the options \u2018--chunk-types\u2019 and \u2018--ports\u2019 can now be used.\n
The translation of conntrack blocks and the \u2018--tcp-flags\u2019 options into nftables rules has been simplified.\n
In libxtables, operation is prohibited when called from executables with the setuid flag.\n
The removal of built-in chains is now permitted in the iptables-nft utility.\n
A rule parser from the arptables-nft utility has been added to iptables-nft.\n
The arptables-nft utility has added support for the \u2018-C\u2019 and \u2018-S\u2019 commands, implemented rule indexing for the \u2018-I\u2019 and \u2018-R\u2019 commands, and added support for the counter syntax \u2018-c N,M\u2019.\n
Support for specifying multiple IPv4 address ranges at once has been discontinued in the *NAT tables.\n
The ability to enable debug output in iptables-restore, iptables-nft, and ebtables-nft through the repeated use of the \u2018-v\u2019 option has been implemented.\n
The performance of the iptables-save and iptables-restore utilities has been improved. <\/ul>\n