nftables vs bpfilter

[macleod]

Disclaimer: I'm not trying to start a religious war

As probably everyone knows, there is a generally "goodbye iptables (in fact netfilter), you served as well" fashion movement in the linux community. Redhat integrated nftables in their firewalld, Debian introduced nftables in latest buster release (on which Proxmox 6 is based) ... etc.

I was intrigued that Proxmox choose to "build" their firewall solution on bpfilter for their 6th release. I must confess that, except the part already included in tcpdump & friends, I am not very familiar with this "solution". And the general opinion (as far as I understood) is like "it should be the next successor - like ipchains > iptables > nftables > bpfilter, but it is not quite ready for full production, not necessarily because of stability, but the not-yet-implemented features".

Would you be so kind to give a little feedback about "why this decision" ? Thank you!

 

[ricardoj]

Hi,

Maybe you can start from this link.

Regards,

Ricardo Jorge

 

[macleod]

Hi,

Maybe you can start from this link.

Regards,

Ricardo Jorge

already read that article, also many other articles related to bpfilter, but still not enough feedback; this "feature" is not (yet) documented as it should be (i.e. like nftables is)
because proxmox 6 is the first big project I know to use bpfilter, I am really curious about the reasons of this choice

 

[ricardoj]

Hi,

There is another one here

The article states "... all while guaranteeing a non-disruptive transition for Linux users".

Let's wait for the response from the Proxmox staff.

Regards,

Ricardo Jorge

 

[fabian]

our firewall is (currently still) iptables based..

 

[macleod]

The new Debian 10 (stretch) has still iptables as main (and default installed) firewall tool, but with nftables support included by default. So even the old firewall will probably work without any change. And you can export as nft list ruleset (after installing nft utility). It's the best solution for compatibility, probably not the best solution for performance (YMMV, depending on the ruleset), but for that you are free to rewrite your firewall as nftables ruleset and load it with the proper tool.

As for proxmox 6, I was digging a little bit and indeed, the bpfilter modules is loaded, but unused, and old netfilter system is "in charge" (iptables is iptables-legacy). But why that "Starting bpfilter" message on the console which intrigued me initially and made me make false assumptions ? Especially because I couldn't pinpoint the source of that message (configuration or start-up scripts).

May I ask what's the roadmap for the proxmox firewall ? (no information of that kind was found on the proxmox roadmap wiki page).
Thank you!

 

[spirit]

The main problem with nftables is the lack of support of conntrack with bridges in netfilter.
(as nftables can't cheat like iptables, using ugly hack to get it work)

a patch has just been send recently
https://lwn.net/Articles/787195/

Not sure that nftables is already updated.

 

[fabian]

our kernel ships the bpfilter module, that's where the startup message comes from. as for our plans, like @spirit said nftables is not yet there unfortunately, but once it is we will re-evaluate and possibly switch over. maybe bpfilter is already advanced and stable enough at that point to skip nftables altogether, who knows

 

[macleod]

thank you very much for the answer!