FS#70252 - [iptables] rename iptables to iptable-legacy and make iptables-nft the default iptables package
Attached to Project:
Arch Linux
Opened by AMM (amish) - Thursday, 01 April 2021, 02:40 GMT
Last edited by Buggy McBugFace (bugbot) - Saturday, 25 November 2023, 20:14 GMT
Opened by AMM (amish) - Thursday, 01 April 2021, 02:40 GMT
Last edited by Buggy McBugFace (bugbot) - Saturday, 25 November 2023, 20:14 GMT
|
Details
Description:
iptables shipped with Arch is legacy iptables which is no more recommended by Netfilter guys. [1] (outdated since 2018 i.e. its outdated since almost 3 years) Netfilter suggested to use nftables OR if not possible then suggestion is to use modern iptables which is based on nf_tables backend. Netfilter guys are no more focusing on legacy iptables. Since iptables-nft is a drop-in replacement for iptables(-legacy), I propose to make (rename) iptables-nft the default iptables package and rename current iptables to iptables-legacy. This way we have a hybrid firewall without any changes by administration. And later they may migrate to nftables completely at their convenience. Major distributions like Fedora, Debian, Ubuntu have already made the switch. [2][3][4] I have switched many of my systems without changing any iptables rule. Those who use non-standard iptables modules can easily switch back by installing iptables-legacy. Proper announcement can be made well in advance to warn such users. Or post install message can be displayed. References: [1] https://ral-arturo.org/2018/06/16/nfws2018.html [2] https://docs.fedoraproject.org/de/fedora/f32/release-notes/sysadmin/Networking/ [3] https://wiki.debian.org/nftables#Current_status [4] https://itsfoss.com/ubuntu-20-10-features/ Additional info: * package version(s) iptables 1:1.8.7-1 iptables-nft 1:1.8.7-1 |
This task depends upon
Closed by Buggy McBugFace (bugbot)
Saturday, 25 November 2023, 20:14 GMT
Reason for closing: Moved
Additional comments about closing: https://gitlab.archlinux.org/archlinux/p ackaging/packages/iptables/issues/1
Saturday, 25 November 2023, 20:14 GMT
Reason for closing: Moved
Additional comments about closing: https://gitlab.archlinux.org/archlinux/p ackaging/packages/iptables/issues/1
There is just no good reason to be using the old backend. Even if you like iptables and don't want to use "nft" you should still be using "nf_tables" backend like most sane distributions, Debian-based, Fedora based do.
One of the reasons I switched my diskless-alpine Linux system to Arch. At least I can manually change them although they will be overwritten on package updates.
[1] https://gitlab.alpinelinux.org/alpine/aports/-/issues/14058
But Arch continues to use legacy iptables as default.
Is there any reason why we continue to use legacy iptables by default and let users switch manually to iptables (nft)
I think we should do reverse, make iptables (nft) default and those who still want deprecated firewall can switch to iptables-legacy. (see comments above)