Consider not switching iptables to legacy implementation

[mquirin]

From https://wiki.debian.org/iptables :

NOTE: iptables is being replaced by nftables starting with Debian Buster

However the pivpn installer switches the implementation back to iptables-legacy:

pivpn/auto_install/install.sh

Lines 450 to 453 in 4e8d4df

	if [[ ${OSCN} == "buster" ]]; then
	$SUDO update-alternatives --set iptables /usr/sbin/iptables-legacy
	$SUDO update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
	fi

I think this goes back to #751 however when I switch my configuration to the nftables back end this works without problem:

$ pivpn debug
::::		Self check		 ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled (it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp

$ iptables -V
iptables v1.8.2 (nf_tables)

$ uname -a
Linux foo 4.19.97-v7+ #1294 SMP Thu Jan 30 13:15:58 GMT 2020 armv7l GNU/Linux

[orazioedoardo]

I think this goes back to #751 however when I switch my configuration to the nftables back end this works without problem:

Fine, but don't you need to create a new rule set to actually use nftables?

[mquirin]

No, the front end is compatible. You would still call the iptables command / use the iptables rule file.
I’m only talking about the backend implementation here, which was switched transparently to nftables in buster and is changed back to to legacy implementation in the pivpn setup script.
I’m just saying we should not need to change the implementation in the background (the original reason seems to be resolved). I think the change of implementation might be confusing for some users (it was for me) and also could cause problems down the line since the main distribution is not using the legacy implementation anymore.

[mquirin]

The below extract from https://wiki.debian.org/iptables is relevant:

NOTE: Debian Buster uses the nftables framework by default.

Starting with Debian Buster, nf_tables is the default backend when using iptables, by means of the iptables-nft layer (i.e, using iptables syntax with the nf_tables kernel subsystem). This also affects ip6tables, arptables and ebtables.