Which is "better" for ease of control - iptables and nftables?

Do people out there have any strong opinions regarding

  • degree of ease of understanding firewall filterring rules?

  • degree of ability/scope to control?

  • degree of ease of fine tuning?

using one or the other?


BTW, not part of discussion, but I do NOT use UFW. No need for it!

3 Likes

well nftables is the future and IMO the better choice for ease of control too. It’s been the official successor since 2014 and every major distro defaults to it now, or uses iptables-nft as a compatibility shim. Even firewalld and UFW use it as their backend. So it’s arguably better time spent to focus on nftables.

5 Likes

as a sidenote:

I know that UFW stands for Uncomplicated Fire Wall.
I dived into it and found the tablesetup quite complicated :laughing:

(Please forgive me, I had a long and complicated day at work :squinting_face_with_tongue:)

5 Likes

Im sure pun intended! :melting_face:

2 Likes

You may want to have a look at iptables vs nftables: What’s New in Linux Firewalling? - DEV Community for side-by-side comparison.

IMO, ufw is easier to use than nft or iptables.

3 Likes

Way back, I was really hoping to use UFW … after first looking at IPTABLES itself to see if I wanted to work with that “beast”.

Unfortunately, UFW did not give me the degree of control that I wanted (it’s been so long since I dug into that, so please don’t ask for details). So, I had to walk away from that and put my efforts into a customized IPTABLES-based firewall.


BTW, I will never understand the move replace the parameter flags (easier to parse out) vs the “indistinguishable” keywords mixed in with the values. That is a move that, to me, is driven by automation of machine recognition, vs ease of recognition and comprehension by Humans. IMHO, Bad Bad Move!!!

2 Likes

It is not clear what to answer until it is clear what is a problem being solved and what kind/degree of control of TCP/IP traffic is desirable.

I like basic introduction into ufw usage at UFW - Community Help Wiki And I find that ufw is pretty easy for common tasks.

Next to it, for complex scenarios and/or uncommon tasks UncomplicatedFirewall - Ubuntu Wiki claims that

the ufw application is capable of doing anything that iptables can do. This is achieved by using several sets of rules files, which are nothing more than iptables-restore compatible text files. Fine-tuning ufw and/or adding additional iptables commands not offered via the ufw command is a matter of editing various text files

3 Likes

Their claims is why I really wanted it to work for me … but it didn’t!

I got tired of pulling my hair to understand the sequencing/prioritization of the various setup files for UFW. Hence, the IPTABLES approach which I took. :slight_smile:

4 Likes