Re: [PATCH mptcp-next v2 0/2] selftests: mptcp: convert iptables to nftables

[Matthieu Baerts]

Hello,

On 03/09/2026 03:12, Hangbin Liu wrote:
> iptables has been deprecated for years. The Linux kernel has included
> nftables as the successor to iptables since 2014, and every major
> distribution uses nftables as the default packet filtering framework.
> The iptables command we run on modern systems is actually iptables‑nft,
> a compatibility layer that translates iptables syntax to nftables rules
> behind the scenes.
> 
> There are also some features that can be set easily with nft, while we need
> to convert to BPF code under iptables, such as MPTCP add‑addr and
> remove‑addr suboptions. To make future work easier, convert iptables usage
> in mptcp to nftables.
> 
> Tested with iptables-translate to make sure each nft conversion is the same
> with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows
FYI, Hangbin is working on a new version addressing my comments from v1.
The new version(s) will be sent to the MPTCP list only, and I will sent
these patches to Netdev when ready.

Updating here the PW status:

pw-bot: cr

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.