[PATCH] wg-quick: linux: add support for nft and prefer it

[Jason A. Donenfeld]

On Tue, Dec 10, 2019 at 6:05 PM Jordan Glover
<Golden_Miller83 at protonmail.ch> wrote:
>
> On Tuesday, December 10, 2019 4:54 PM, Jason A. Donenfeld <Jason at zx2c4.com> wrote:
>
> > On Tue, Dec 10, 2019 at 5:52 PM Jordan Glover
> > Golden_Miller83 at protonmail.ch wrote:
> >
> > > On Tuesday, December 10, 2019 3:48 PM, Jason A. Donenfeld Jason at zx2c4.com wrote:
> > >
> > > > If nft(8) is installed, use it. These rules should be identical to the
> > > > iptables-restore(8) ones, with the advantage that cleanup is easy
> > > > because we use custom table names.
> > >
> > > I wonder if nft should be used only if iptables isn't installed instead.
> > > Nowadays iptables has nft backend which I believe is default and will
> > > translate iptables rules to nft automatically. On my system iptables rules
> > > from wg-quck are already shown in "nft list ruleset".
> > > I'm not sure if this work in reverse - are nft rules automatically translated
> > > to iptables and shown in iptables-save? If not then using iptables of available
> > > seems more versatile for the job.
> >
> > iptables rules and nftables rules can co-exist just fine, without any
> > translation needed. Indeed if your iptables is symlinked to
> > iptables-nft, then you'll insert nftables rules when you try to insert
> > iptables rules, but it really doesn't matter much either way (AFAIK).
> > I figured I'd prefer nftables over iptables if available because I
> > presume, without any metrics, that nftables is probably faster and
> > slicker or something.
>
> As I said before, my concern is more about people being fully aware of state
> of their firewall rather than if it technically works.

Ahh, I see what you're wondering. Well, `wg-quick` shows `[#] nft -f
-` in it's output, so an administrator should be aware that running
`nft list ruleset` or similar is how to gain some visibility, I
suppose.

Perhaps when we eventually can drop RHEL7 support, we'll even drop
iptables support all together.