<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - issue with DNAT port range"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1501#c8">Comment # 8</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - issue with DNAT port range"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1501">bug 1501</a>
from <span class="vcard"><a class="email" href="mailto:marco.drummer@outlook.com" title="marco.drummer@outlook.com">marco.drummer@outlook.com</a>
</span></b>
<pre>(In reply to Phil Sutter from <a href="show_bug.cgi?id=1501#c7">comment #7</a>)
I am currently using iptables v1.8.7 (nf_tables) on Ubuntu 22.04.2 LTS
Almost all of my rules are converted to nft to make use of the advantages and
simplifications in syntax.
However since shifted port ranges are still not available I still have a single
rule that is being applied by iptables_nft
<span class="quote">> What performance and compatibility drawbacks are you talking about in
> particular?</span >
Nftables are generally "advertised" as being faster than the old xtables kernel
structures, which together with being pushed away from legacy iptables by more
and more distributions is why I did this.
<span class="quote">>
> Why would iptables not print anything? Any rule created with iptables-nft
> will
> be listed correctly by iptables-nft(-save).
>
> Cheers, Phil</span >
At the moment nft list ruleset prints:
chain PREROUTING {
meta l4proto tcp tcp dport 5500-5600 counter packets 14219
bytes 579188 dnat to 10.212.0.1:21500-21600;5500
}
This rule was set by iptables-nft since nft does not support it.
However if newer versions of nft will no longer print this since it is
essentially wrong syntax I have no means to see that rule is active
since iptables-nft refuses to print any output:
iptables v1.8.7 (nf_tables): table `nat' is incompatible, use 'nft' tool.
You will probably tell me that mixing nft and iptables is the issue and I
agree, but more and more distributions are finding ways to force people towards
nft, but things like shifted port ranges are still not available.
So either this interoperability has to keep working without silently dropping
non-parsable rules from the nft output or nft tables needs to implement missing
features.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>