RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
iptables-save omits references to tables in nftables which are not recognized by iptables-nft commands.
this makes debugging of firewall rules harder for people who use this command to see installed iptables rules

Version-Release number of selected component (if applicable):
iptables-1.8.4-9.el8.x86_64
kernel-4.18.0-187.el8.x86_64

How reproducible:
always, non-iptables-nft based tables exist

Steps to Reproduce:
nft -f - <<EOF
flush ruleset
table inet inet_all {}
table ip inet4 {}
table ip6 inet6 {}
EOF

iptables-save
ip6tables-save

Actual results:
with iptables-1.8.2-16.el8
iptables-save
# Table `inet4' is incompatible, use 'nft' tool.
ip6tables-save
# Table `inet6' is incompatible, use 'nft' tool.

with iptables-1.8.4-9.el8
iptables-save; ip6tables-save
<nothing printed>

Expected results:
list of tables that are incompatible with iptables ruleset:
 1. return printing of ip family related tables
 2. add inet family tables to output of both- ipv4/ipv6 iptables-save output
iptables-save
# Table `inet4' is incompatible, use 'nft' tool.
# Table `inet_all' is incompatible, use 'nft' tool.  <-- this would be added

Additional info:

Hi Tomas,

This was changed as part of resolving bug 1626541. Reverting to the old behaviour is hard to achieve, recent iptables-nft doesn't even fetch tables it doesn't care about from kernel anymore (that's a performance optimization).

I fear the best way of dealing with the situation is to use nft tool in order to get the full picture?

Cheers, Phil

Hello Phil,

thanks for quick reply. I filed this from user experience point of view, but I am ok with preferring performance over this feature if there's no clean way around. The sole reason was to help iptables-based users to debug their machines more easily. Unfortunately I very seldomly saw direct use of iptables-save commands anyway.

Hi Tomas,

With legacy iptables, you don't see any nftables rules, either. So with firewalld and nftables backend in place, neither legacy nor nft iptables give a full picture.