{"id":3614,"date":"2022-12-20T17:09:09","date_gmt":"2022-12-20T20:09:09","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/iptables-translate-man8\/"},"modified":"2022-12-20T17:09:09","modified_gmt":"2022-12-20T20:09:09","slug":"iptables-translate-man8","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/iptables-translate-man8\/","title":{"rendered":"IPTABLES-TRANSLATE (man8)"},"content":{"rendered":"

IPTABLES-TRANSLATE<\/h1>\n

NAME<\/a>
DESCRIPTION<\/a>
USAGE<\/a>
EXAMPLES<\/a>
LIMITATIONS<\/a>
SEE ALSO<\/a>
AUTHORS<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

iptables-translate \u2014 translation tool to migrate from iptables to nftables<\/p>\n

ip6tables-translate \u2014 translation tool to migrate from ip6tables to nftables<\/p>\n

DESCRIPTION <\/a> <\/h2>\n

There is a set of tools to help the system administrator translate a given ruleset from iptables(8)<\/b> and ip6tables(8)<\/b> to nftables(8)<\/b>.<\/p>\n

The available commands are:<\/p>\n\n\n\n\n\n
<\/td>\n\n

\u2022<\/p>\n<\/td>\n

<\/td>\n\n

iptables-translate<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n\n

\u2022<\/p>\n<\/td>\n

<\/td>\n\n

iptables-restore-translate<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n\n

\u2022<\/p>\n<\/td>\n

<\/td>\n\n

ip6tables-translate<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n\n

\u2022<\/p>\n<\/td>\n

<\/td>\n\n

ip6tables-restore-translate<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

USAGE <\/a> <\/h2>\n

They take as input the original iptables(8)<\/b>\/ip6tables(8)<\/b> syntax and output the native nftables(8)<\/b> syntax.<\/p>\n

The iptables-restore-translate<\/b> tool reads a ruleset in the syntax produced by iptables-save(8)<\/b>. Likewise, the ip6tables-restore-translate<\/b> tool reads one produced by ip6tables-save(8)<\/b>. No ruleset modifications occur, these tools are text converters only.<\/p>\n

The iptables-translate<\/b> reads a command line as if it was entered to iptables(8)<\/b>, and ip6tables-translate<\/b> reads a command like as if it was entered to ip6tables(8)<\/b>.<\/p>\n

EXAMPLES <\/a> <\/h2>\n

Basic operation examples.<\/p>\n

Single command translation:<\/p>\n

root@machine:~# iptables-translate -A INPUT -p tcp –dport 22 -m conntrack –ctstate NEW -j ACCEPT
nft add rule ip filter INPUT tcp dport 22 ct state new counter accept<\/p>\n

root@machine:~# ip6tables-translate -A FORWARD -i eth0 -o eth3 -p udp -m multiport –dports 111,222 -j ACCEPT
nft add rule ip6 filter FORWARD iifname eth0 oifname eth3 meta l4proto udp udp dport { 111,222} counter accept<\/p>\n

Whole ruleset translation:<\/p>\n

root@machine:~# iptables-save > save.txt
root@machine:~# cat save.txt
# Generated by iptables-save v1.6.0 on Sat Dec 24 14:26:40 2016
*filter
:INPUT ACCEPT [5166:1752111]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5058:628693]
-A FORWARD -p tcp -m tcp –dport 22 -m conntrack –ctstate NEW -j ACCEPT
COMMIT
# Completed on Sat Dec 24 14:26:40 2016<\/p>\n

root@machine:~# iptables-restore-translate -f save.txt
# Translated by iptables-restore-translate v1.6.0 on Sat Dec 24 14:26:59 2016
add table ip filter
add chain ip filter INPUT { type filter hook input priority 0; }
add chain ip filter FORWARD { type filter hook forward priority 0; }
add chain ip filter OUTPUT { type filter hook output priority 0; }
add rule ip filter FORWARD tcp dport 22 ct state new counter accept<\/p>\n

root@machine:~# iptables-restore-translate -f save.txt > ruleset.nft
root@machine:~# nft -f ruleset.nft
root@machine:~# nft list ruleset
table ip filter {<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
<\/td>\n<\/td>\n\n

chain INPUT {<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n <\/td>\n <\/td>\n\n

type filter hook input priority 0; policy accept;<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n<\/td>\n\n

}<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n<\/td>\n\n

chain FORWARD {<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n <\/td>\n <\/td>\n\n

type filter hook forward priority 0; policy accept;<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n <\/td>\n <\/td>\n\n

tcp dport ssh ct state new counter packets 0 bytes 0 accept<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n<\/td>\n\n

}<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n<\/td>\n\n

chain OUTPUT {<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n
<\/td>\n <\/td>\n <\/td>\n\n

type filter hook output priority 0; policy accept;<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n<\/td>\n\n

}<\/p>\n<\/td>\n

 <\/td>\n<\/tr>\n<\/table>\n

}<\/p>\n

LIMITATIONS <\/a> <\/h2>\n

Some (few) extensions may be not supported (or fully-supported) for whatever reason (for example, they were considered obsolete, or we didn\u2019t have the time to work on them).<\/p>\n

There are no translations available for ebtables(8)<\/b> and arptables(8)<\/b>.<\/p>\n

To get up-to-date information about this, please head to https:\/\/wiki.nftables.org\/<\/b>.<\/p>\n

SEE ALSO <\/a> <\/h2>\n

nft(8)<\/b>, iptables(8)<\/b><\/p>\n

AUTHORS <\/a> <\/h2>\n

The nftables framework is written by the Netfilter project (https:\/\/www.netfilter.org).<\/p>\n

This manual page was written by Arturo Borrero Gonzalez .<\/p>\n

This documentation is free\/libre under the terms of the GPLv2+.<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

iptables-translate \u2014 translation tool to migrate from iptables to nftables ip6tables-translate \u2014 translation tool to migrate from ip6tables to nftables <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[5,52,4,730],"class_list":["post-3614","post","type-post","status-publish","format-standard","hentry","category-8-administracion-del-sistema","tag-5","tag-administracion","tag-man8","tag-xtables-translate"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/3614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=3614"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/3614\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=3614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=3614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=3614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}