Re: iptables-1.8.11 review

On 9/12/25 3:37 AM, Xi Ruoyao ([email protected] via blfs-support Mailing List) wrote:
> On Thu, 2025-09-11 at 23:14 -0500, Randy McMurchy wrote:
>> Hi all,
>>
>> I was a bit surprised to see iptables still in the BLFS book. I tried to
>> look
>> back in the -dev archives to see why nftables is not in the book, but I
>> really
>> couldn't find anything other than 5 years ago Bruce could not get in
>> touch with
>> DJ so nftables (and its dependencies) were archived. There's really nothing
>> useful in the -dev archives since then that I could find.
>>
>> But that's not what I'm writing about. I noticed there are many flaws in the
>> iptables instructions. I will point them out, and if agreed that changes
>> need
>> to be made to the instructions, I can submit a patch. This has nothing to do
>> with configuring a firewall, my aim is pointing out mistakes in the install
>> instructions only.
>>
>> First, the Note at the beginning is not applicable any longer unless perhaps
>> it is referring to the bpf-utils optional dependency which I did not install
>> as it seems complicated and the package is unmaintained. Documentation
>> on the
>> netfilter.org web site and in the INSTALL file clearly states that using raw
>> kernel headers is no longer required. Anything it needs now comes from
>> /usr/include/linux.
>>
>> Second, and this could be because I deviated from the book (yes, I know,
>> that's why I'm writing in -support instead of -dev). The configure command
>> I used is as follows:
>>
>> ./configure --prefix=/usr --enable-libipq --enable-nfsynproxy  \
>>               --enable-bpf-compiler --sysconfdir=/etc
>>
>> Note the last sysconfdir entry. My installation installed
>> /etc/ethertypes and
>> if you don't specify the sysconfdir, the file ends up in /usr/etc/. Note
>> that
>> I also removed the --disable-nftables option.
>>
>> Third, the package now ships a fairly intensive test suite. It must be
>> run by
>> root, and the /etc/ethertypes file needs to be installed before the
>> tests are
>> run. The shipped ethertypes file is in the etc directory of the source tree.
>>
>> Here is some output from the tests using the command:
>> grep -Ev ': OK|[OK]|^make' test.log
>>
>> =============================================================
>> Making check in libiptc
>> Making check in libxtables
>> Making check in include
>> Making check in libipq
>> Making check in utils
>> Making check in extensions
>> Making check in iptables
>> ./extensions/generic.txlate: Fail
>>
>> ./extensions/generic.txlate: Fail
>>
>> ./extensions/generic.txlate: Fail
>>
>> ./extensions/generic.txlate: Fail
>>
>> 85 test files, 450 tests, 446 tests passed, 0 tests failed, 4 errors
>> FAIL: xlate-test.py
>> legacy: 123 test files, 1693 unit tests, 1691 passed
>>
>> nft: 144 test files, 2002 unit tests, 2000 passed
>> total: 144 test files, 3695 unit tests, 3691 passed
>> FAIL: iptables-test.py
>>
>> W: [FAILED]
>> ././iptables/tests/shell/testcases/iptables/0008-unprivileged_0:
>> expected 0 but got 131
>> W: [FAILED]
>> ././iptables/tests/shell/testcases/iptables/0008-unprivileged_0:
>> expected 0 but got 131
>> FAIL: iptables/tests/shell/run-tests.sh
>> ===================
>> 3 of 3 tests failed
>> ===================
>> =============================================================
>>
>> Fourth, it probably wouldn't hurt to expand just a bit the
>> --disable-nftables "Command Explanation". Maybe say something like
>> "Remove this switch if you have installed nftables and desire the
>> compatibility layer."
> 
> I'll take a look at first and third.  For second IMO we can just say
> something like "also add --sysconfdir=/etc if you use this switch" for -
> -disable-nftables explanation.
> 
> I'm unsure if we should just replace iptables with nftables as I heard
> from many resources that it's supposed to be a replacement.

My personal opinion is that the configuration syntax for nftables sucks. AFAIK, it is 
just there to be consistent with commercial Cisco products.

   -- Bruce

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-support
Unsubscribe: See the above information page