Given a host that is in an unknown state of configuration, I would like to know if there is an effective way of non-interactively determining if the firewall rule set in place is managed by iptables or nftables.

Sounds pretty simple and I've given this quite a bit of thought, but haven't come back with a meaningful answer to put on a script...


A variant of this problem was addressed recently in Kubernetes, so it’s worth looking at what was done there. (The variant is whether to use iptables-legacy or iptables-nft and their IPv6 variants to drive the host’s rules.)

The approach taken in Kubernetes is to look at the number of lines output by the respective “save” commands, iptables-legacy-save and iptables-nft-save (and their IPv6 variants). If the former produces ten lines or more of output, or produces more output than the latter, then it’s assumed that iptables-legacy should be used; otherwise, that iptables-nft should be used.

In your case, the decision tree could be as follows:

  • if iptables isn’t installed, use nft;
  • if nft isn’t installed, use iptables;
  • if iptables-save doesn’t produce any rule-defining output, use nft;
  • if nft list tables and nft list ruleset don’t produce any output, use iptables.

If iptables-save and nft list ... both produce output, and iptables isn’t iptables-nft, I’m not sure an automated process can decide.

  • Interesting. What I am finding is that iptables-save, iptables-legacy-save and iptables-nft-save all return null output (on debian) if an nft ruleset is defined. If a rule is defined using iptables-nft, then the output of iptables-nft-save returns data reflecting the change, but not the entirety of the nft ruleset (not necessarily an issue in this particular case), yet the nft ruleset is updated to contain the change added with iptables-nft. I think I can work out a solution from this information, thank you. – Pedro May 26 '20 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.