Wasn't there an ipchains ---> iptables compatibility mode?

Posted Mar 24, 2009 17:58 UTC (Tue) by felixfix (subscriber, #242)
Parent article: Nftables: a new packet filtering engine

Been a while since I did much with packet filtering, since my setups haven't changed much. Wasn't there a compatibility mode when iptables was introduced, or a converter?

to post comments

Wasn't there an ipchains ---> iptables compatibility mode?

Posted Mar 24, 2009 18:40 UTC (Tue) by wstearns (subscriber, #4102) [Link] (2 responses)

I'm getting rusty (the pun was truly unintentional) on this, but I believe there was an ipchains kernel module that loaded on top of an iptables architecture kernel. You could do most ipchains tasks with it. You could not mix rules (some ipchains rules and some iptables rules); it was an all-or-nothing switch.

I wrote userspace converters that respectively turned an ipfwadm firewall file into an ipchains firewall (ipfwadm2ipchains) or turned an ipchains firewall into an iptables firewall (ipchains2iptables). Neither created a perfect conversion (there are architectural differences in the firewalls that can't be perfectly converted), but both covered the majority of rules correctly.

The tools can be found at www.stearns.org/i2i/ . Like sausage, they're functional but ugly in their implementation.
-- Bill Stearns

Wasn't there an ipchains ---> iptables compatibility mode?

Posted Mar 25, 2009 1:00 UTC (Wed) by dlang (guest, #313) [Link] (1 responses)

there were a lot over conversion scripts, but nothing in the kernel.

You are totally wrong

Posted Mar 26, 2009 7:51 UTC (Thu) by khim (subscriber, #9252) [Link]

Google for "ipchains emulation" and you'll find tons of links to messages about problems with said in-kernel emulation. May be this is why you remember only conversion scripts? IPchains emulation was incomplete and ineffective - that's why most admins just converted scripts: it was easier to convert scripts then to fight problems in emulation. But is was there - that's for sure...