Bug#916918: iptables translation issues

[Arturo Borrero Gonzalez]

Control: reassign -1 iptables 1.8.3-2

This bugs really belongs to the iptables-translate binary which lives in the
iptables package rather than in nft.

Bug#916918: iptables translation issues

[Arturo Borrero Gonzalez]

Control: tags -1 upstream
Control: forwarded -1 https://bugzilla.netfilter.org/show_bug.cgi?id=1362

On Thu, 20 Dec 2018 15:19:25 +0200 debian-reportbug-2...@ssd.axu.tm wrote:
> Package: nftables
> Version: 0.9.0-2
> Severity: normal
> 
> The following examples used to work with native iptables, but either 
> fail or produce the wrong functionality with nftables:
> 
> bash# iptables-translate -4 -A bogoncheck -m set --match-set bogons4 src 
> -j DROP
> nft # -4 -A bogoncheck -m set --match-set bogons4 src -j DROP
> bash#
> 
> (i.e. fails to translate rule)

There is not translation possible for this AFAIK. Sorry for that.
See here for more info:

https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_ipset_to_nftables

The rest of the bug report was forwarded upstream.

thanks!

Bug#916918: iptables translation issues

[debian-reportbug-2018]

Package: nftables
Version: 0.9.0-2
Severity: normal

The following examples used to work with native iptables, but either 
fail or produce the wrong functionality with nftables:


bash# iptables-translate -4 -A bogoncheck -m set --match-set bogons4 src 
-j DROP

nft # -4 -A bogoncheck -m set --match-set bogons4 src -j DROP
bash#

(i.e. fails to translate rule)

bash# iptables-translate -A INPUT -s 0.0.0.0/8 -j DROP
nft add rule ip filter INPUT counter drop
bash#

(ignores source address match to yield a rule that drops everything)
(0.0.0.0/8 != 0.0.0.0/0)

bash# iptables-translate -6 -A protect-re -s 2001:db8:19::/64 -p tcp 
--sport 80 -j ACCEPT
nft add rule ip filter protect-re ip6 saddr 2001:db8::::0:0/0 
tcp sport 80 counter accept

bash#

(borks the source address match completely)

The last example is converted correctly by ip6tables-translate. But as I 
used to have ipv4 and ipv6 rules in the same file, I'm baffled by why 
iptables-restore-translate even tries to convert the ipv6 rules. Surely 
it should just skip them?


I also ran into a baffling error message for a rule that uses the 
multiport module, and couldn't find a workaround or even what the real 
problem was:


iptables-translate-restore v1.8.2 (nf_tables): multiport needs `-p tcp', 
`-p udp', `-p udplite', `-p sctp' or `-p dccp'


Here's an attempt to manually translate the line in question:

bash# iptables-translate -4 -A protect-re  -m multiport -p udp -s 
10.0.0.0/24 --ports 161,514  -j ACCEPT
nft # -4 -A protect-re -m multiport -p udp -s 10.0.0.0/24 --ports 
161,514 -j ACCEPT

bash#

Best Regards,

--
Aleksi Suhonen