iptables has been deprecated for years. The Linux kernel has included nftables as the successor to iptables since 2014, and every major distribution uses nftables as the default packet filtering framework. The iptables command we run on modern systems is actually iptables‑nft, a compatibility layer that translates iptables syntax to nftables rules behind the scenes.
There are also some features that can be set easily with nft, while we need to convert to BPF code under iptables, such as MPTCP add‑addr and remove‑addr suboptions. To make future work easier, convert iptables usage in mptcp to nftables. Signed-off-by: Hangbin Liu <[email protected]> --- Hangbin Liu (2): selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh selftests: mptcp: convert iptables to nftables for mptcp_join.sh tools/testing/selftests/net/mptcp/config | 3 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 136 ++++++++------------- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 56 ++++----- 4 files changed, 77 insertions(+), 120 deletions(-) --- base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529 change-id: 20260902-mptcp_nft-b892782ef929 Best regards, -- Hangbin Liu <[email protected]>
