Arch Linux

Please read this before reporting a bug:

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#70252 - [iptables] rename iptables to iptable-legacy and make iptables-nft the default iptables package

Attached to Project: Arch Linux
Opened by AMM (amish) - Thursday, 01 April 2021, 02:40 GMT
Last edited by Antonio Rojas (arojas) - Monday, 31 January 2022, 17:06 GMT
Task Type Bug Report
Category Packages: Core
Status Assigned
Assigned To Ronald van Haren (pressh)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 0%
Votes 5
Private No


iptables shipped with Arch is legacy iptables which is no more recommended by Netfilter guys. [1] (outdated since 2018 i.e. its outdated since almost 3 years)

Netfilter suggested to use nftables OR if not possible then suggestion is to use modern iptables which is based on nf_tables backend. Netfilter guys are no more focusing on legacy iptables.

Since iptables-nft is a drop-in replacement for iptables(-legacy), I propose to make (rename) iptables-nft the default iptables package and rename current iptables to iptables-legacy.

This way we have a hybrid firewall without any changes by administration. And later they may migrate to nftables completely at their convenience.

Major distributions like Fedora, Debian, Ubuntu have already made the switch. [2][3][4]

I have switched many of my systems without changing any iptables rule.

Those who use non-standard iptables modules can easily switch back by installing iptables-legacy.

Proper announcement can be made well in advance to warn such users. Or post install message can be displayed.


Additional info:
* package version(s)
iptables 1:1.8.7-1
iptables-nft 1:1.8.7-1
This task depends upon

Comment by AMM (amish) - Wednesday, 20 April 2022, 08:45 GMT
One year passed. Is anyone looking in to it? I see task keeps getting reassigned. We really need to move out of legacy iptables.
Comment by Daniel Gray (dngray) - Wednesday, 27 July 2022, 07:01 GMT
I would really like to see this happen. Default to legacy xtables causes issues when you use something that expects to make "iptables" rules like libvirtd, podman, docker etc. Docker containers which use nft inside them, won't even work unless you're using nf_tables on the host You cannot mix and match the two.

There is just no good reason to be using the old backend. Even if you like iptables and don't want to use "nft" you should still be using "nf_tables" backend like most sane distributions, Debian-based, Fedora based do.

One of the reasons I switched my diskless-alpine Linux system to Arch. At least I can manually change them although they will be overwritten on package updates.

Comment by Daniel Gray (dngray) - Wednesday, 27 July 2022, 07:10 GMT
I just found you can install "iptables-nft" this will remove legacy xtables, so really all that is needed is updating it on the archiso media.
Comment by nl6720 (nl6720) - Wednesday, 27 July 2022, 07:16 GMT
The packages on the ISO don't matter for installed systems. The proposed iptables->iptables-legacy, iptables-nft->iptables changes are still needed to properly fix this.