On Tue, 21 Jan 2020, Vitaly Potyarkin wrote: > > Package: ufw > Severity: wishlist > > Hello, > > I've been using ufw for a long time to configure firewall rules on Debian 8 > and > Debian 9. Current stable (Debian 10) has switched default firewall engine to > nftables. > > If I understand correctly that is not a problem yet. Ufw keeps working because > Debian provides compatibility wrappers to support old-style iptables API with > new firewall framework. But will that be the case for future releases of > Debian?
The iptables package provides both iptables-nft and iptables-legacy. iptables-nft uses netfilter as the backend and iptables-legacy uses the old xtables backend. ufw is intended and confirmed to work when the admin configures the system for either (via the alternatives mechanism), as is the case in Debian 10 (buster). There are no plans to remove the iptables package from Debian bullseye. Upstream netfilter recognizes that there is so much inertia with iptables that they decided to develop and maintain iptables-nft as a drop in replacement which is command-line identical to the old xtables iptables (ie, iptables-legacy). As such, there is no pressing need for ufw (or any other iptables-using frontend) to move to using nftables to drive netfilter. That said, there have been bugs in iptables-nft where its behavior differs from iptables-legacy, but upstream has been responsive to those issues. The main thing to keep in mind is that you just don't want to mix the kernel implementations. Ie, if netfilter, then people can use nftables and iptables-nft freely, but not iptables-legacy. If xtables, then use only iptables-legacy and not nftables or iptables-nft. > Are there any plans in upstream ufw project to support nftables backend? Yes. As mentioned, ufw already supports netfilter via iptables-nft, which is configured as the default on Debian when installing iptables. ufw is architected to be able to choose different backends with the intention of supporting driving netfilter via nftables. Since iptables-nft exists and works for ufw's needs, there hasn't yet been a compelling reason to invest in a pure nftables backend. If circumstances or features dictate, this will change. > Should users continue to rely on ufw or should they look for other software to > manage their firewalls? ufw is actively maintained and supports modern Debian systems and kernels today. Note, as of this moment, there are 2 bugs in Debian unstable that prevent ufw from working with iptables-nft. * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949518 (new iptables bug) * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921680 (in progress) (once 949518 is fixed, I'll upload 0.36-2 for 921680. In the meantime, you can use iptables, libip4tc2, libip6tc2, libiptc0 and libxtables12 1.8.3-2 from: http://snapshot.debian.org/package/iptables/1.8.3-2/. Again this is only temporary when using Debian unstable). -- Email: [email protected] IRC: jdstrand
