Moving from iptables to nf tables

mogorman · December 2, 2021, 6:08pm

i tried switch over from iptables to nftables on 21.11 but still got

Dec 02 `02:26:13 random n8fjignniq0nd7x6z45kh8aldl26lrfb-nftables-check[18427]: Unload ip_tables before using nftables!

I thought ip_tables was using the nf_tables backend?

I disabled firewall and other things. I am running docker so i imagine this could be related to that?

is it possible for me to move to nf tables but still use older docker containers?

misuzu · December 2, 2021, 8:48pm

mogorman:

i tried switch over from iptables to nftables on 21.11 but still got
Dec 02 `02:26:13 random n8fjignniq0nd7x6z45kh8aldl26lrfb-nftables-check[18427]: Unload ip_tables before using nftables!

This should be fixed by

github.com/NixOS/nixpkgs

nixos/nftables: Allow use with iptables

NixOS:master ← jess-sch:patch-1

opened 02:31PM - 02 May 21 UTC

jess-sch

+4 -12

This pull request removes the checkScript portion of the nftables module (which …currently prevents nftables from being used together with iptables) and updates the relevant documentation.  ###### Motivation for this change Since iptables and nftables do not actually conflict with each other, there's no real reason to artificially prevent people from combining them. What happens if you combine the two is [well-defined](https://wiki.nftables.org/wiki-nftables/index.php/Troubleshooting#Question_4._How_do_nftables_and_iptables_interact_when_used_on_the_same_system.3F). The current "prevent nftables from being used with iptables" policy causes issues like #88643. ###### Things done - [ ] Tested using sandboxing ([nix.useSandbox](https://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](https://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux) - Built on platform(s) - [x] NixOS - [ ] macOS - [ ] other Linux distributions - [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests)) - [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review wip"` - [ ] Tested execution of all binary files (usually in `./result/bin/`) - [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after) - [x] Ensured that relevant documentation is up to date - [x] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).