> I wish Linux’s firewalls were so easy to configure.
nft (nftables) is easy and has a similar pf-like 'feel' while offering way more functionality. After decades of `iptables` (and `ipchains` before) nft(ables) is a breath of fresh air.
I still greatly prefer pf, but yes, nftables is vastly better than iptables. Ipchains always looked like a RAM dump converted to Forth. It got the job done, mostly, but I never could understand how it got popular when the BSDs were already using nicer alternatives.
Iptables suffers from the common "it's a command line program so we are going to use getopt to parse it" I find the getopt style... tolerable at best for short commands. But for long expressions in a dsl(like find or iptables) it is noisy and ugly. Iptables would have been twice as nice to use if they got rid of all the pointless dashes(and I have written preprocessors to do just this).
The clearest example of this was the megaraid command for lsi raid cards. It's commands are documented in the getopt style but I accidentally found out that the dashes were optional. And while the syntax was still sort of ass, my scripts were much easier to read.
Nftables is a step forward in the Linux firewall. It evolved a lot in the last years and nowadays it really requires that the tooling linked to iptables setups do the migration step.
nft (nftables) is easy and has a similar pf-like 'feel' while offering way more functionality. After decades of `iptables` (and `ipchains` before) nft(ables) is a breath of fresh air.