Re: [PATCH mptcp-next v2 0/2] selftests: mptcp: convert iptables to nftables

Hello,

On 03/09/2026 03:12, Hangbin Liu wrote:

iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

Tested with iptables-translate to make sure each nft conversion is the same
with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows

FYI, Hangbin is working on a new version addressing my comments from v1.
The new version(s) will be sent to the MPTCP list only, and I will sent
these patches to Netdev when ready.

Updating here the PW status:

pw-bot: cr

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.