user2837961
New Member
OS: Debian 11 x86_64
I am looking to convert some of my iptable rules to nftables.
I have tried to use iptables-translate, but it is not translating all of my rules.
My original iptables script:
The equivalent nftables script would be something like this ...
Can anyone please assist in providing the equivalent nftable rules?
I am looking to convert some of my iptable rules to nftables.
I have tried to use iptables-translate, but it is not translating all of my rules.
My original iptables script:
Bash:
#!/bin/sh
sudo apt install iptables
# accept ports 500 and 4500, required for IKEv2
sudo iptables -A INPUT -p udp --dport 500 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 4500 -j ACCEPT
# forward ESP
sudo iptables -A FORWARD --match policy --pol ipsec --dir in --proto esp -s 10.1.1.1/24 -j ACCEPT
sudo iptables -A FORWARD --match policy --pol ipsec --dir out --proto esp -d 10.1.1.1/24 -j ACCEPT
# more forwarding
sudo iptables -t nat -A POSTROUTING -s 10.1.1.1/24 -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.1.1.1/24 -o eth0 -j MASQUERADE
# fix fragmentation
sudo iptables -t mangle -A FORWARD --match policy --pol ipsec --dir in -s 10.1.1.1/24 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
sudo apt install iptables-persistent
# make persistent
sudo netfilter-persistent save
sudo netfilter-persistent reloadThe equivalent nftables script would be something like this ...
Code:
#!/bin/sh
sudo apt install nftables
# Enable NFTables as a service and start
sudo systemctl enable nftables
sudo systemctl start nftables
# ------------
# ????? nftable rules here ????
# ------------
sudo nft list ruleset > /etc/nftables.confCan anyone please assist in providing the equivalent nftable rules?
Last edited:
