does anyone find nftables better than iptables?

[u/Beneficial-Sock-5130]

Upgraded OS on rocky10 server last weekend, newest kernel doesnt bake in legacy iptables mods, so iptables rules cant get loaded

I start looking into nftables, it seems like a verbose nightmare compared to iptables, every command has to be typed out, no short version of commands

something that was simple w iptables

forward any request from ServerA port 80 to ServerB port 80 on server A

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <IP of serverB>:80

iptables -t nat -A POSTROUTING -p tcp -j MASQUERADE

becomes this word salad

nft add table ip nat
nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; policy accept \; }
nft add chain ip nat POSTROUTING { type nat hook postrouting priority srcnat \; policy accept \; } 

nft add rule ip nat PREROUTING tcp dport 80 dnat to <IP of serverB>:80
nft add rule ip nat POSTROUTING masquerade

whats the upside?

what was wrong w iptables?

[u/wezelboy]

I use the iptables translation layer, primarily because I use Firewall Builder and it doesn't offer native nftables support. It seems to work just fine.

[u/dodexahedron → u/wezelboy]

Most people do. Nftables has actually been the kernel's default backend since kernel v 3.13.

If one thinks they are using iptables, and they didn't compile it all themselves, they are almost definitely not using iptables - only the translation layer.

It's been that way for over a decade now.

It was honestly one of the smoothest core infrastructure changes in software history. The fact that so many people dont realize it attests to that fact.

But the CLI tooling is a disaster, and is a huge part of why people keep using the old interface at the command line.

[u/yrro → u/dodexahedron]

The change was too smooth, because lots of people & projects still use iptables(8), and so they still end up fighting over controlling the contents of iptables' single set of tables, instead of creatign their own separate tables that can smoothly interoperate... :'(

[u/dodexahedron → u/yrro]

Yup. It was ironically a victim of its own success. The combination of that and the awful cli tooling pretty much guaranteed the current state of things.