3

I have this rule for iptables

iptables -I INPUT 1 -i eth0 -p tcp -s 192.168.178.20 --dport 8201 -j REJECT

I was looking for how to translate rules tutorials but couldn't find them. How do I create that rule with nftables? Or is the syntax the same?

1 Answer 1

4

From nftables wiki:

Since June 2018, the old xtables/setsockopt tools are considered legacy. However, there is support to use the iptables/ip6tables/arptables/ebtables old syntax with the nf_tables kernel backend. This is described with further details in the Legacy xtables tools wiki page.

You can use iptables-nft to achieve your goal like below:

iptables-nft -I INPUT 1 -i eth0 -p tcp -s 192.168.178.20 --dport 8201 -j REJECT

After that entering, iptabels-nft-save will apply your rules. You can confirm that this rule exists in nftables by:

nft list ruleset

You have to see something like this:

nft list ruleset                 
table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
                iifname "eth0" ip saddr 192.168.178.20 tcp dport 8201 counter packets 0 bytes 0 reject
        }
}

In addition you can directly translate your rules using the below syntax:

iptables-translate -I INPUT 1 -i eth0 -p tcp -s 192.168.178.20 --dport 8201 -j REJECT

which will give you the following output:

nft insert rule ip filter INPUT iifname "eth0" ip saddr 192.168.178.20 tcp dport 8201 counter reject

Also, you can just save all of your iptables rules like iptables-save > save.txt and then use iptables-restore-translate -f save.txt to get the translated rules.

Take a look at my own question a few months back for further explanation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .