1IPTABLES-TRANSLATE(8)       System Manager's Manual      IPTABLES-TRANSLATE(8)
2
3
4

NAME

6       iptables-translate — translation tool to migrate from iptables to nfta‐
7       bles
8
9       ip6tables-translate — translation tool to  migrate  from  ip6tables  to
10       nftables
11

DESCRIPTION

13       There  is  a  set of tools to help the system administrator translate a
14       given ruleset from iptables(8) and ip6tables(8) to nftables(8).
15
16       The available commands are:
17
18
19       · iptables-translate
20
21       · iptables-restore-translate
22
23       · ip6tables-translate
24
25       · ip6tables-restore-translate
26
27

USAGE

29       They take as input the  original  iptables(8)/ip6tables(8)  syntax  and
30       output the native nftables(8) syntax.
31
32       The  iptables-restore-translate tool reads a ruleset in the syntax pro‐
33       duced by iptables-save(8).  Likewise,  the  ip6tables-restore-translate
34       tool reads one produced by ip6tables-save(8).  No ruleset modifications
35       occur, these tools are text converters only.
36
37       The iptables-translate reads a command line as if  it  was  entered  to
38       iptables(8),  and ip6tables-translate reads a command like as if it was
39       entered to ip6tables(8).
40
41

EXAMPLES

43       Basic operation examples.
44
45       Single command translation:
46
47       root@machine:~# iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
48       nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
49
50       root@machine:~# ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport --dports 111,222 -j ACCEPT
51       nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept
52
53       Whole ruleset translation:
54
55       root@machine:~# iptables-save > save.txt
56       root@machine:~# cat save.txt
57       # Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
58       *filter
59       :INPUT ACCEPT [5166:1752111]
60       :FORWARD ACCEPT [0:0]
61       :OUTPUT ACCEPT [5058:628693]
62       -A FORWARD -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
63       COMMIT
64       # Completed on Sat Dec 24 14:26:40 2016
65
66       root@machine:~# iptables-restore-translate -f save.txt
67       # Translated by iptables-restore-translate v1.6.0 on Sat Dec 24 14:26:59 2016
68       add table ip filter
69       add chain ip filter INPUT { type filter hook input priority 0; }
70       add chain ip filter FORWARD { type filter hook forward priority 0; }
71       add chain ip filter OUTPUT { type filter hook output priority 0; }
72       add rule ip filter FORWARD tcp dport 22 ct state new counter accept
73
74       root@machine:~# iptables-restore-translate -f save.txt > ruleset.nft
75       root@machine:~# nft -f ruleset.nft
76       root@machine:~# nft list ruleset
77       table ip filter {
78            chain INPUT {
79                 type filter hook input priority 0; policy accept;
80            }
81
82            chain FORWARD {
83                 type filter hook forward priority 0; policy accept;
84                 tcp dport ssh ct state new counter packets 0 bytes 0 accept
85            }
86
87            chain OUTPUT {
88                 type filter hook output priority 0; policy accept;
89            }
90       }
91
92
93

LIMITATIONS

95       Some (few) extensions may be not  supported  (or  fully-supported)  for
96       whatever  reason  (for  example,  they  were considered obsolete, or we
97       didn't have the time to work on them).
98
99       There are no translations available for ebtables(8) and arptables(8).
100
101       To  get   up-to-date   information   about   this,   please   head   to
102       https://wiki.nftables.org/.
103
104

SEE ALSO

106       nft(8), iptables(8)
107
108

AUTHORS

110       The   nftables   framework   is   written   by  the  Netfilter  project
111       (https://www.netfilter.org).
112
113       This manual page was written by Arturo Borrero Gonzalez <arturo@netfil‐
114       ter.org>.
115
116       This documentation is free/libre under the terms of the GPLv2+.
117
118
119
120                                 May 14, 2019            IPTABLES-TRANSLATE(8)
Impressum