git.iko.soy/typeable/nixpkgs
on master help sign in
nixos/doc: improve release notes for iptables-nft and systemd with nftables backend

This change probably wasn't documented sufficiently in the release notes, neither the fact systemd stopped using iptables on its own in case of nf_tables support. Fixes #156041.

commit753a43caf07790a923d8f6394744f1c5b0eb8ee4 authorFlorian Klink <flokli@flokli.de> dateTue 22 Feb 2022, 23:14 (5 years ago) parent99c18ca
2 files changed+29−3
compare with master
unifiedsplit
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+20−2 nixos/doc/manual/release-notes/rl-2111.section.md+9−1
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+20−2
@@ -26,8 +26,26 @@
2626 </listitem>
2727 <listitem>
2828 <para>
29− <literal>iptables</literal> now uses
30− <literal>nf_tables</literal> backend.
29+ <literal>iptables</literal> is now using
30+ <literal>nf_tables</literal> under the hood, by using
31+ <literal>iptables-nft</literal>, similar to
32+ <link xlink:href="https://wiki.debian.org/nftables#Current_status">Debian</link>
33+ and
34+ <link xlink:href="https://fedoraproject.org/wiki/Changes/iptables-nft-default">Fedora</link>.
35+ This means, <literal>ip[6]tables</literal>,
36+ <literal>arptables</literal> and <literal>ebtables</literal>
37+ commands will actually show rules from some specific tables in
38+ the <literal>nf_tables</literal> kernel subsystem.
39+ </para>
40+ </listitem>
41+ <listitem>
42+ <para>
43+ systemd got an <literal>nftables</literal> backend, and
44+ configures (networkd) rules in their own
45+ <literal>io.systemd.*</literal> tables. Check
46+ <literal>nft list ruleset</literal> to see these rules, not
47+ <literal>iptables-save</literal> (which only shows
48+ <literal>iptables</literal>-created rules.
3149 </para>
3250 </listitem>
3351 <listitem>
nixos/doc/manual/release-notes/rl-2111.section.md+9−1
@@ -8,7 +8,15 @@ In addition to numerous new and upgraded packages, this release has the followin
88
99- Nix has been updated to version 2.4, reference its [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on what has changed. The previous version of Nix, 2.3.16, remains available for the time being in the `nix_2_3` package.
1010
11−- `iptables` now uses `nf_tables` backend.
11+- `iptables` is now using `nf_tables` under the hood, by using `iptables-nft`,
12+ similar to [Debian](https://wiki.debian.org/nftables#Current_status) and
13+ [Fedora](https://fedoraproject.org/wiki/Changes/iptables-nft-default).
14+ This means, `ip[6]tables`, `arptables` and `ebtables` commands will actually
15+ show rules from some specific tables in the `nf_tables` kernel subsystem.
16+
17+- systemd got an `nftables` backend, and configures (networkd) rules in their
18+ own `io.systemd.*` tables. Check `nft list ruleset` to see these rules, not
19+ `iptables-save` (which only shows `iptables`-created rules.
1220
1321- PHP now defaults to PHP 8.0, updated from 7.4.
1422