Hello, On 03/09/2026 03:12, Hangbin Liu wrote: > iptables has been deprecated for years. The Linux kernel has included > nftables as the successor to iptables since 2014, and every major > distribution uses nftables as the default packet filtering framework. > The iptables command we run on modern systems is actually iptables‑nft, > a compatibility layer that translates iptables syntax to nftables rules > behind the scenes. > > There are also some features that can be set easily with nft, while we need > to convert to BPF code under iptables, such as MPTCP add‑addr and > remove‑addr suboptions. To make future work easier, convert iptables usage > in mptcp to nftables. > > Tested with iptables-translate to make sure each nft conversion is the same > with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows FYI, Hangbin is working on a new version addressing my comments from v1. The new version(s) will be sent to the MPTCP list only, and I will sent these patches to Netdev when ready.
Updating here the PW status: pw-bot: cr Cheers, Matt -- Sponsored by the NGI0 Core fund.
