NFTABLES IS ,LINUX'S CURRENT
PACKET-FILTERING FRAMEWORK  MERGED IN
KERNEL #C4AC "<,JANUARY #BJAD"> UNDER
NETFILTER'S ,PATRICK ,MC,HARDY1
REPLACING THE IPTABLES FAMILY
"<IP_/IP#F_/ARP_/EB"> WITH ONE SUBSYSTEM
AND ONE USERSPACE TOOL1 NFT4 ,WHERE
IPTABLES HARDCODED FOUR SEPARATE TABLE
CHAINS PER PROTOCOL1 NFTABLES IS A SMALL
REGISTER-MACHINE3 RULES COMPILE TO
BYTECODE THE KERNEL EXECUTES  JUMPS1
COMPARISONS1 SET LOOKUPS1 VERDICTS  SO A
DECADE OF BOLT-ON IPTABLES EXTENSIONS
BECAME EXPRESSIONS IN A REAL GRAMMAR4
,WHAT IT BUYS YOU
,THE PRACTICAL WINS3 NAMED SETS AND MAPS
"<IP SADDR _< #AJ4J4J4A1 #AJ4J4J4G _>
INLINE1 OR MUTABLE SETS YOU ADD TO
WITHOUT REWRITING RULES">1 VMAPS
"<LOOKUP  VERDICT">1 THE INET FAMILY
"<,I,PV#D "6 ,I,PV#F IN ONE TABLE  THE
REASON NFT KILLS THE DUAL-RULEBOOK
PROBLEM">1 ATOMIC RULESET REPLACEMENT
"<NFT -;F SWAPS THE WORLD IN ONE
TRANSACTION">1 AND IPTABLES-TRANSLATE
FOR MIGRATING OLD RULES4 ,THE NETDEV
FAMILY EVEN FILTERS AT INGRESS BEFORE
PACKETS REACH THE STACK4
,READING IT
NFT LIST RULESET PRINTS THE WHOLE
FIREWALL AS A SCRIPT  TABLES OWN CHAINS
OWN RULES1 TYPE FILTER HOOK INPUT
PRIORITY FILTER2 POLICY DROP2 DECLARES
THE CHAIN'S PLACE IN THE PIPELINE1 AND
COUNTERS SIT INLINE4 ,THE MIGRATION
STORY IS GENTLE BY DESIGN3 IPTABLES
COMMANDS STILL WORK THROUGH COMPAT
TRANSLATION ON MOST DISTROS1 BUT
ANYTHING NEW IS WRITTEN IN NFT  CHAPTER
#AH'S FIREWALL SECTION AND THE SECURITY
CHAPTER'S HARDENING CHECKLIST BOTH SPEAK
IT NATIVELY4
,SEE ALSO
- ,NETWORKING  WHERE NFT FIRST APPEARS
IN THE HANDBOOK - ,LINUX ,SECURITY  THE
HARDENING CHECKLIST USES IT - ,INSIDE A
,LINUX ,SYSTEM  NETFILTER'S PLACE IN THE
KERNEL - ,LINUX  ,WIRE,GUARD  ,S,E,LINUX