Current status of nftables for openvpnas?

taupehat

Redhat et seq. are deprecating the iptables driver (and spamming the console about it). I see "Settings related to iptables" in the official docs but nothing about nftables there. Yes, I can install the compatibility layer and make it go but I'm going to get pushback on that the moment the boss logs into the console and sees the deprecation message.
So I can answer the question he will with complete certainty ask: how soon can we swap to what isn't deprecated so we can do something simple like replace "iptables.web=true" with "nftables.web=true" in our systems?

openvpn_inc

Hello taupehat,

At the moment AS still depends on iptables. This is being reworked into nftables at this very moment. When it is actually delivered to customers is hard to answer. Most likely this year. That's all we can tell you on this topic at the moment. The compatibility will work fine until then.

Kind regards,
Johan

esteban78

taupehat wrote Redhat et seq. are deprecating the iptables driver (and spamming the console about FirstProgress it). I see "Settings related to iptables" in the official docs but nothing about nftables there. Yes, I can install the compatibility layer and make it go but I'm going to get pushback on that the moment the boss logs into the console and sees the deprecation message.
So I can answer the question he will with complete certainty ask: how soon can we swap to what isn't deprecated so we can do something simple like replace "iptables.web=true" with "nftables.web=true" in our systems?

Red Hat is actively promoting nftables as the future of firewalling. While there's no exact timeline for a complete transition, you can start planning the migration now. This involves learning nftables syntax, manually converting iptables rules or using tools like iptables-translate, and thorough testing. By starting the migration, you can address the deprecation warnings and ensure a smooth transition to nftables.