Un certain nombre de personnes (dont moi) ont demandé pourquoi il était nécessaire de réinventer la roue et est-ce qu'il ne serait pas mieux d'importer directement l'outil d'OpenBSD (pf) qui semble apprécié de tous.
La réponse :
"To clarify: I certainly did consider the way pf does things and there are quite a few things I like better than in iptables, starting with having a language specifically designed for filtering rules, compared to the quite primitive shell command invocation mainly used with iptables.
But porting the kernel side doesn't make sense at all. The code structure doesn't match how things are done in the Linux kernel, the API doesn't match what we want, its tightly coupled to a different NAT and state tracking system and even basic things like rule evaluation order are different from what iptables does. There's no way to transform it into something that can be backwards compatible with iptables/ip6tables/arptables/ebtables without basically rewriting it."
# Linux Weekly News
Posté par patrick_g (site web personnel) . En réponse au journal NFtables, successeur d'Iptables. Évalué à 9.
Un certain nombre de personnes (dont moi) ont demandé pourquoi il était nécessaire de réinventer la roue et est-ce qu'il ne serait pas mieux d'importer directement l'outil d'OpenBSD (pf) qui semble apprécié de tous.
La réponse :
"To clarify: I certainly did consider the way pf does things and there are quite a few things I like better than in iptables, starting with having a language specifically designed for filtering rules, compared to the quite primitive shell command invocation mainly used with iptables.
But porting the kernel side doesn't make sense at all. The code structure doesn't match how things are done in the Linux kernel, the API doesn't match what we want, its tightly coupled to a different NAT and state tracking system and even basic things like rule evaluation order are different from what iptables does. There's no way to transform it into something that can be backwards compatible with iptables/ip6tables/arptables/ebtables without basically rewriting it."