Why is pve-firewall.service forcing use of iptables-legacy at boot time on PVE 7.4?

[phep]

Hi,
Well, pretty much everything is in the subject line: pve-firewall.service is calling update-alternatives to switch to iptables-legacy unconditionally. Should we not use iptables-nft on 7.4?
Thanks in advance,

 

[encryptedserver]

I also think Proxmox should move to nftables.

 

[spirit]

maybe for proxmox8, I need a full rewrite, because conntrack need to be managed at bridge level as bridge-nf-call-iptables is not possible with nftables.