Arturo Borrero, a Debian developer and a member of the Coreteam of the Netfilter project, is responsible for maintaining the Debian packages associated with nftables, iptables, and netfilter. to translate the significant next release of the Debian 11 distribution to default to nftables. If this proposal is approved, packages with iptables will be classified as optional options and will not be included in the base distribution.
The Nftables packet filter is notable for unifying the filtering interfaces for IPv4, IPv6, ARP, and network bridges. Nftables provides a kernel-level generic interface that is protocol-independent and offers core functions for extracting data from packets, performing data operations, and managing traffic. The actual filtering logic and protocol-specific handlers are compiled into bytecode in user space, which is then loaded into the kernel through the Netlink interface and executed in a special virtual machine resembling BPF (Berkeley Packet Filters).
By default, Debian 11 also offers to utilize the dynamic firewall firewalld, designed as a wrapper over nftables. Firewalld runs as a background process, allowing for dynamic changes to the packet filtering rules via DBus, without the need to reload the filtering rules or disrupt established connections. The firewall is managed using the firewall-cmd utility, which, when creating rules, is based not on IP-címeknetwork interfaces and port numbers, but on service names (for example, to allow access to SSH, you need to execute “firewall-cmd --add --service=ssh”, and to close SSH — “firewall-cmd --remove --service=ssh”).
Forrás: opennet.ru
