On Tue, Dec 10, 2019 at 6:05 PM Jordan Glover <[email protected]> wrote: > > On Tuesday, December 10, 2019 4:54 PM, Jason A. Donenfeld <[email protected]> > wrote: > > > On Tue, Dec 10, 2019 at 5:52 PM Jordan Glover > > [email protected] wrote: > > > > > On Tuesday, December 10, 2019 3:48 PM, Jason A. Donenfeld [email protected] > > > wrote: > > > > > > > If nft(8) is installed, use it. These rules should be identical to the > > > > iptables-restore(8) ones, with the advantage that cleanup is easy > > > > because we use custom table names. > > > > > > I wonder if nft should be used only if iptables isn't installed instead. > > > Nowadays iptables has nft backend which I believe is default and will > > > translate iptables rules to nft automatically. On my system iptables rules > > > from wg-quck are already shown in "nft list ruleset". > > > I'm not sure if this work in reverse - are nft rules automatically > > > translated > > > to iptables and shown in iptables-save? If not then using iptables of > > > available > > > seems more versatile for the job. > > > > iptables rules and nftables rules can co-exist just fine, without any > > translation needed. Indeed if your iptables is symlinked to > > iptables-nft, then you'll insert nftables rules when you try to insert > > iptables rules, but it really doesn't matter much either way (AFAIK). > > I figured I'd prefer nftables over iptables if available because I > > presume, without any metrics, that nftables is probably faster and > > slicker or something. > > As I said before, my concern is more about people being fully aware of state > of their firewall rather than if it technically works.
Ahh, I see what you're wondering. Well, `wg-quick` shows `[#] nft -f -` in it's output, so an administrator should be aware that running `nft list ruleset` or similar is how to gain some visibility, I suppose. Perhaps when we eventually can drop RHEL7 support, we'll even drop iptables support all together. _______________________________________________ WireGuard mailing list [email protected] https://lists.zx2c4.com/mailman/listinfo/wireguard
