Introduction
nftable is a kernel packet filtering framework to replaces iptables. It brings no changes in the core (conntrack, hooks).
Match logic is changed: you fetch keys and once you have your key set, you make operation on them. Advanced and specialized matchs are built upon this system.
nftables vs iptables
In iptables, extension were coded in separate files and they must be put in iptables source tree. To act, they must modify on a binary array storing the ruleset and injecting it back to the kernel. So every update involve a full download and upload of the whole ruleset.
nftables is working on a message based basis (exchanged via netlink) and thus allow better handling of incremental modification.
Nftables usage
nftables will provide a high level library which can be used to manipulate ruleset in dedicated tools.
From userspace, backward compatibility is here with utilities fully compatible iptables and ip6tables. Even script wil not have been changed
But there is some new things brought by the change:
- event notifications: can have a software listening to rules change and logging the change. This is an interesting feature as tracability is often asked in secure environment
- Better incremental rule update support
- Enable or disable the chains per table you want (will provide performance optimisation)
There is work in progress on a new utility nft. It will provide a new syntax that will allow to do more efficient matching. It will be possible to form couple of keys and do high speed matching on them.