On 14 June 2017 at 11:58, Florian Westphal <[email protected]> wrote: > Arturo Borrero Gonzalez <[email protected]> wrote: >> I'm curious, What is the use case of using both nftables and iptables >> at the same time? >> Some missing functionality in nft? >> Perhaps some ipt->nft partial migration procedure? > > Yes, partial migration. > > Right now there are an awful lot of tools out there (docker, libvirt, > kubernetes, ..) that call iptables(-restore) directly (or inject them via > firewalld). >
Well, just quickly checked firewalld code [0]. It relies so massively in ipXtables/ipset that I bet a migration to nftables would require a major rewrite. Not sure if iptables-compat address this case, or even a high level libnftables. [0] https://github.com/t-woerner/firewalld/blob/master/src/firewall/core/ipXtables.py -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
