1XTABLES-TRANSLATE(8)        System Manager's Manual       XTABLES-TRANSLATE(8)
2
3
4

NAME

6       xtables-translate - translation tools to migrate from iptables to nfta‐
7       bles
8
9

DESCRIPTION

11       There is a set of tools to help the system  administrator  translate  a
12       given ruleset from iptables(8) and ip6tables(8) to nftables(8).
13
14       The available commands are:
15
16
17       · iptables-translate
18
19       · iptables-restore-translate
20
21       · ip6tables-translate
22
23       · ip6tables-restore-translate
24
25

USAGE

27       They  take  as  input  the original iptables(8)/ip6tables(8) syntax and
28       output the native nftables(8) syntax.
29
30       The iptables-restore-translate tool reads a ruleset in the syntax  pro‐
31       duced  by  iptables-save(8).  Likewise, the ip6tables-restore-translate
32       tool reads one produced by ip6tables-save(8).  No ruleset modifications
33       occur, these tools are text converters only.
34
35       The  iptables-translate  reads  a  command line as if it was entered to
36       iptables(8), and ip6tables-translate reads a command like as if it  was
37       entered to ip6tables(8).
38
39

EXAMPLES

41       Basic operation examples.
42
43       Single command translation:
44
45       root@machine:~# iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
46       nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
47
48       root@machine:~# ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
49       nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept
50
51       Whole ruleset translation:
52
53       root@machine:~# iptables-save > save.txt
54       root@machine:~# cat save.txt
55       # Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
56       *filter
57       :INPUT ACCEPT [5166:1752111]
58       :FORWARD ACCEPT [0:0]
59       :OUTPUT ACCEPT [5058:628693]
60       -A FORWARD -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
61       COMMIT
62       # Completed on Sat Dec 24 14:26:40 2016
63
64       root@machine:~# iptables-restore-translate -f save.txt
65       # Translated by iptables-restore-translate v1.6.0 on Sat Dec 24 14:26:59 2016
66       add table ip filter
67       add chain ip filter INPUT { type filter hook input priority 0; }
68       add chain ip filter FORWARD { type filter hook forward priority 0; }
69       add chain ip filter OUTPUT { type filter hook output priority 0; }
70       add rule ip filter FORWARD tcp dport 22 ct state new counter accept
71
72       root@machine:~# iptables-restore-translate -f save.txt > ruleset.nft
73       root@machine:~# nft -f ruleset.nft
74       root@machine:~# nft list ruleset
75       table ip filter {
76            chain INPUT {
77                 type filter hook input priority 0; policy accept;
78            }
79
80            chain FORWARD {
81                 type filter hook forward priority 0; policy accept;
82                 tcp dport ssh ct state new counter packets 0 bytes 0 accept
83            }
84
85            chain OUTPUT {
86                 type filter hook output priority 0; policy accept;
87            }
88       }
89
90
91

LIMITATIONS

93       Some  (few)  extensions  may  be not supported (or fully-supported) for
94       whatever reason (for example, they  were  considered  obsolete,  or  we
95       didn't have the time to work on them).
96
97       There are no translations available for ebtables(8) and arptables(8).
98
99       To   get   up-to-date   information   about   this,   please   head  to
100       https://wiki.nftables.org/.
101
102

SEE ALSO

104       nft(8), xtables-compat(8)
105
106

AUTHORS

108       The  nftables  framework  is   written   by   the   Netfilter   project
109       (https://www.netfilter.org).
110
111       This manual page was written by Arturo Borrero Gonzalez <arturo@netfil‐
112       ter.org>.
113
114       This documentation is free/libre under the terms of the GPLv2+.
115
116
117
118                                 Mar 16, 2018             XTABLES-TRANSLATE(8)
Impressum