Talk:Nftables

This is the talk page for discussing improvements to the Nftables article.
This is not a forum for general discussion of the article's subject.

Put new text under old text. Click here to start a new topic.
New to Wikipedia? Welcome! Learn to edit; get help.

Article policies

Find sources: Google (books · news · scholar · free images · WP refs) · FENS · JSTOR · TWL

This article was nominated for deletion on 1 July 2009. The result of the discussion was keep.

Computing: Networking / Software / Free and open-source software Low‑importance

This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing articles

Low

This article has been rated as Low-importance on the project's importance scale.

This article is supported by Networking task force (assessed as Mid-importance).

This article is supported by WikiProject Software.

This article is supported by WikiProject Computer Security (assessed as Mid-importance).

This article is supported by Free and open-source software (assessed as Mid-importance).

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Answer question about Same-origin_policy
Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Linux Mid‑importance

	Linux portal This article is within the scope of WikiProject Linux, a collaborative effort to improve the coverage of Linux on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.LinuxWikipedia:WikiProject LinuxTemplate:WikiProject LinuxLinux articles
Mid	This article has been rated as Mid-importance on the project's importance scale.

Unnamed section[edit]

What happened to this project? Still no news? 87.217.10.211 (talk) 07:42, 2 May 2010 (UTC)[reply]

As of today, still no news. Some development happened in 2010, but nothing since more than 12 month (according to the git of Patrick McHardy on kernel.org). I believe the page should be modified again to state that the project is no longer under development (since may 2010, not 2009) (the email cited in the march 2011 update by user Stevenwagner are more than one year old). Emmanuel Deloget (talk) 15:29, 21 July 2011 (UTC)[reply]

This is an ancient question, and talk pages are for discussion of the wikipedia page, but I would like anyone seeing this to know that nftables is very active, useful, and deployed in many places. Bepvte (talk) 14:43, 24 January 2019 (UTC)[reply]

what is it?[edit]

Introduction: "nftables is an engine and utility program" Is it just a utility program like iptables, or is it a software comprising a utility program AND some engine code? ScotXW (talk) 09:48, 22 October 2013 (UTC)[reply]

The sentence is quite clear, it says it's an engine and utility program. -- Dsimic (talk) 12:21, 22 October 2013 (UTC)[reply]

Got the language improved a bit for additional clarity. -- Dsimic (talk) 12:33, 22 October 2013 (UTC)[reply]

Official nftables is the project that aims to replace the existing {ip,ip6,arp,eb}tables framework. Basically, this project provides a new packet filtering framework, a new userspace utility and also a compatibility layer for {ip,ip6}tables. nftables is built upon the building blocks of the Netfilter infrastructure such as the existing hooks, the connection tracking system, the userspace queueing component and the logging subsystem. ScotXW (talk) 20:33, 26 October 2013 (UTC)[reply]

Right, but nftables is also the name of the userspace binary used for configuring the kernel part, besides the kernel part itself being also called nftables. Anyway, got the heading section extended, for additional clarity. -- Dsimic (talk) 21:46, 26 October 2013 (UTC)[reply]

No, according to netfilter.org the new userspace utility is called nft. AFAIR it was to be called nftables, but it seems they decided for the shorter variant. ScotXW (talk) 11:41, 27 October 2013 (UTC)[reply]

You're right, it was my bad, thanks for pointing that out. Git tree also confirms that. Got the article updated accordingly. -- Dsimic (talk) 14:28, 27 October 2013 (UTC)[reply]

software architecture[edit]

Conforming to Linux User Magazine germany, among the differences to netfilter are:

nftables is part of the network stack instead of sitting on top of the network stack; this removes the necessity to pass data from the network stack to the actual packet filter
is implemented as a "virtual machine" (though I do not understand what this is supposed to mean!)
handles IPv4, IPv6, ARP and EB withouth code duplication in contrast to netfilter
nftables shall replace netfilter, and nft shall replace iptables, ip6tables, arptables and ebtables!

For netfilter there is File:Netfilter-components.svg, the code works on top of the network stack and there is a lot of code duplication between the different modules (ipv4, ipv6, arp and eb). Something similar would be nice for nftables. User:ScotXW^t@lk 11:41, 18 April 2015 (UTC)[reply]

Berkeley Packet Filter[edit]

It appears that Extended Berkeley Packet Filter (eBPF) is going to be the new kernel infrastructure for building firewalls, not npt as previously planned:

-- ScratchMonkey (talk) 11:13, 24 October 2019 (UTC)[reply]