Package: nftables
Version: 0.9.0-2
Severity: normal
The following examples used to work with native iptables, but either
fail or produce the wrong functionality with nftables:
bash# iptables-translate -4 -A bogoncheck -m set --match-set bogons4 src
-j DROP
nft # -4 -A bogoncheck -m set --match-set bogons4 src -j DROP
bash#
(i.e. fails to translate rule)
bash# iptables-translate -A INPUT -s 0.0.0.0/8 -j DROP
nft add rule ip filter INPUT counter drop
bash#
(ignores source address match to yield a rule that drops everything)
(0.0.0.0/8 != 0.0.0.0/0)
bash# iptables-translate -6 -A protect-re -s 2001:db8:19::/64 -p tcp
--sport 80 -j ACCEPT
nft add rule ip filter protect-re ip6 saddr 2001:db8::ffff:ffff:0:0/0
tcp sport 80 counter accept
bash#
(borks the source address match completely)
The last example is converted correctly by ip6tables-translate. But as I
used to have ipv4 and ipv6 rules in the same file, I'm baffled by why
iptables-restore-translate even tries to convert the ipv6 rules. Surely
it should just skip them?
I also ran into a baffling error message for a rule that uses the
multiport module, and couldn't find a workaround or even what the real
problem was:
iptables-translate-restore v1.8.2 (nf_tables): multiport needs `-p tcp',
`-p udp', `-p udplite', `-p sctp' or `-p dccp'
Here's an attempt to manually translate the line in question:
bash# iptables-translate -4 -A protect-re -m multiport -p udp -s
10.0.0.0/24 --ports 161,514 -j ACCEPT
nft # -4 -A protect-re -m multiport -p udp -s 10.0.0.0/24 --ports
161,514 -j ACCEPT
bash#
Best Regards,
--
Aleksi Suhonen
