On Tue, Dec 10, 2019 at 6:13 PM Roman Mamedov <rm@romanrm.net> wrote:
nftables is slower than iptables across pretty much every metric[1][2]. It
only wins where a pathological case is used for the iptables counterpart (e.g.
tons of single IPs as individual rules and without ipset). It is a disaster
that it is purported to be the iptables replacement, just for the syntax and
non-essential whistles such as updating rules in place or something. And
personally I don't prefer the new syntax either. It's the systemd and
pulseaudio story all over again, where something more convoluted, less reliable
and of lower quality is passed for a replacement of stuff that actually worked,
but was deemed "unsexy" and arbitrarly declared as deprecated.

[1] http://www.diva-portal.org/smash/get/diva2:1212650/FULLTEXT01.pdf
[2] https://developers.redhat.com/blog/2017/04/11/benchmarking-nftables/

I'm seeing the pages you linked are dated 2018 and 2017. I'm seeing this article [1] dated June 2018 talks about an "important improvement of performance", and though I don't see any evidence backing the statement I'd expect more improvements given than more than one year has passed.
Do you know whether the worse performance you're talking about is still the case on recent Linux releases?

I'd say +1 for nftables but just for the syntax which I do like better. I'll leave the discussion on performance to experts.

[1] https://www.zevenet.com/knowledge-base/nftlb/nftlb-benchmarks-and-performance-keys/