https://wiki.nftables.org/wiki-nftables/index.php/Atomic_rule_replacement

https://wiki.nftables.org/wiki-nftables/index.php/Scripting

Some progress.

In other words, iptabels is already symlinked to iptabels-nft anyhow. Therefore Whonix is already using iptabels-nft.

• https://unix.stackexchange.com/questions/722007/translate-firewall-rule-from-iptables-to-nftables
• https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

In T509#20232, @ak88 wrote:

Any updates on this?

Any updates on this?

It looks like bpfilter is in rather early stages, and it's few years until we'll see it in Debian.

Or skip nftables and use Berkeley Packet Filter (BPF)?

NonaSuomy:

Added requested NFTables example from duclicsic #netfilter freenode.

Starting with Bullseye nftables will be the default:

https://researchut.com/post/migrating-firewall-to-nftables/

nftables transition info:

Please note that Qubes 4.0 will use nftables (if available):
https://github.com/QubesOS/qubes-issues/issues/974#issuecomment-251825457

Yes, one day, nftables may be a good idea. Also, one day, IPv6 support may not be avoided if it is so widespread that Whonix would stand out without having IPv6 support.

Works.

• https://github.com/Whonix/usability-misc/commit/81ff389dcadd390d52bae810ad06c8365b574d27
• https://github.com/Whonix/usability-misc/commit/5a9f39dc9d7e576425b50c38a0be7d46847a0c41
• https://github.com/Whonix/usability-misc/commit/f946e06b06e73c0f251ae39def4114c1e7082776
• https://github.com/Whonix/usability-misc/commit/c26bfb72de8dd797ed79d2f41686f5f3d5ac3e62

simplify running OpenVPN as unprivileged user
https://github.com/Whonix/usability-misc/commit/91482787adedabaea6fa0e369784c0d4a05b41c0

create user 'tunnel'
https://github.com/Whonix/whonix-gw-firewall/commit/00724fd517e66fed0fb52051635aecb9f8e8dca3