Re: Introducing shorewall-nft
Winston Sorfleet <[email protected]> Mon, 20 Jul 2026 00:56:49 -0400
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============7454074324707694749== Content-Type: multipart/alternative; boundary="------------bxDnBq35nMw0XPZ1wUZeL4g2" Content-Language: en-US This is a multi-part message in MIME format. --------------bxDnBq35nMw0XPZ1wUZeL4g2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit I echo this. I got into Shorewall because I wanted an easy way to stay sane with multi-ISP (where I live, the fast provider didn't give static IP nor IPv6; DSL provided both but was hardly fast). Shorewall[6] has been a lifesaver and I'm eternally grateful to Tom, so if Dave is willing to take up the banner and give back to Shorewall, thank you! On 2026-07-19 4:24 a.m., [email protected] wrote: > Well done David, > > What a fantastic initiative to preserve the outstanding firewall > abstraction provided by Shorewall, together with the years of > development effort to support that abstraction. > > Moving to Python is a great way forward. > > I’ve been dreading migrating from Shorewall. You’ve given me hope. > > Cheers, > > Bruce > > >> On 19 Jul 2026, at 14:56, Dave Kempe <[email protected]> wrote: >> >> >> Hi Shorewall people! >> >> We (sol1.com.au <http://sol1.com.au>) have been avid Shorewall users >> and supporters for around 20 years. Wow that is a long time. We have >> a fleet of managed firewalls that use Shorewall, among other things, >> to keep many of our customers online and secure. The decline of >> Shorewall has been "a problem for another day" for a long time now, >> and I finally decided to do something about it. >> >> Shorewall-nft is a Python ground up rewrite, specifically to support >> keeping your shorewall config the same, but it emits pure nftables. >> >> https://github.com/sol1/shorewall-nft >> >> We are running it on many of our systems already, in fact, these >> packets are flowing to you over it right now. It was tested and >> developed against a primary fleet of 45 different firewall configs, >> including all the standard configurations and much of the weirder >> configurations represented. >> >> Our aim is to replace Shorewall with shorewall-nft, and continue >> supporting it. Our team has managed custom software and linux >> firewalls for years, and would be honoured to become custodians of >> this project. Of course we welcome all input, and this is a true Open >> Source project. >> >> We would love some feedback on whether it works for you. You can >> simply grab the deb or rpm, do a shorewall check and shorewall >> migrate, and it will flush your old rules and switch you to nftables. >> >> As bonus features, we also built shorewall-lsm, a Link Status Monitor >> with multi-ISP support that appears to be working well and geoip >> improvements along they way. Any improvements maintain backwards >> config capability, and simply add to the existing config base. >> See https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md >> for more info on shorewall-lsm >> >> Happy to provide support or see FRs via github infrastructure. If the >> project gets legs at all, we will consider a docs site or other >> further improvements. >> >> Thanks >> Dave Kempe >> >> >> _______________________________________________ >> Shorewall-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/shorewall-users > > > _______________________________________________ > Shorewall-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/shorewall-users --------------bxDnBq35nMw0XPZ1wUZeL4g2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <p>I echo this. I got into Shorewall because I wanted an easy way to stay sane with multi-ISP (where I live, the fast provider didn't give static IP nor IPv6; DSL provided both but was hardly fast). Shorewall[6] has been a lifesaver and I'm eternally grateful to Tom, so if Dave is willing to take up the banner and give back to Shorewall, thank you!</p> <div class="moz-cite-prefix">On 2026-07-19 4:24 a.m., <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> wrote:<br> </div> <blockquote type="cite" cite="mid:[email protected]"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="ltr">Well done David,</div> <div dir="ltr"><br> </div> <div dir="ltr">What a fantastic initiative to preserve the outstanding firewall abstraction provided by Shorewall, together with the years of development effort to support that abstraction.</div> <div dir="ltr"><br> </div> <div dir="ltr">Moving to Python is a great way forward.</div> <div dir="ltr"><br> </div> <div dir="ltr">I’ve been dreading migrating from Shorewall. You’ve given me hope.</div> <div dir="ltr"><br> </div> <div dir="ltr">Cheers,</div> <div dir="ltr"><br> </div> <div dir="ltr">Bruce</div> <div dir="ltr"><br> </div> <div dir="ltr"><br> <blockquote type="cite">On 19 Jul 2026, at 14:56, Dave Kempe <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a> wrote:<br> <br> </blockquote> </div> <blockquote type="cite"> <div dir="ltr"> <div dir="ltr"> <div>Hi Shorewall people!</div> <div><br> </div> <div>We (<a href="http://sol1.com.au" moz-do-not-send="true">sol1.com.au</a>) have been avid Shorewall users and supporters for around 20 years. Wow that is a long time. We have a fleet of managed firewalls that use Shorewall, among other things, to keep many of our customers online and secure. The decline of Shorewall has been "a problem for another day" for a long time now, and I finally decided to do something about it.</div> <div><br> </div> <div>Shorewall-nft is a Python ground up rewrite, specifically to support keeping your shorewall config the same, but it emits pure nftables.</div> <div><br> <a href="https://github.com/sol1/shorewall-nft" moz-do-not-send="true" class="moz-txt-link-freetext">https://github.com/sol1/shorewall-nft</a></div> <div><br> </div> <div>We are running it on many of our systems already, in fact, these packets are flowing to you over it right now. It was tested and developed against a primary fleet of 45 different firewall configs, including all the standard configurations and much of the weirder configurations represented.</div> <div><br> </div> <div>Our aim is to replace Shorewall with shorewall-nft, and continue supporting it. Our team has managed custom software and linux firewalls for years, and would be honoured to become custodians of this project. Of course we welcome all input, and this is a true Open Source project.</div> <div><br> </div> <div>We would love some feedback on whether it works for you. You can simply grab the deb or rpm, do a shorewall check and shorewall migrate, and it will flush your old rules and switch you to nftables.</div> <div><br> </div> <div>As bonus features, we also built shorewall-lsm, a Link Status Monitor with multi-ISP support that appears to be working well and geoip improvements along they way. Any improvements maintain backwards config capability, and simply add to the existing config base.<br> </div> <div>See <a href="https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md" moz-do-not-send="true" class="moz-txt-link-freetext">https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md</a> for more info on shorewall-lsm</div> <div><br> </div> <div>Happy to provide support or see FRs via github infrastructure. If the project gets legs at all, we will consider a docs site or other further improvements.</div> <div><br> </div> <div>Thanks</div> <div>Dave Kempe</div> <div><br> </div> <div><br> </div> </div> <span>_______________________________________________</span><br> <span>Shorewall-users mailing list</span><br> <span><a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a></span><br> <span><a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/shorewall-users">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a></span><br> </div> </blockquote> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <br> <fieldset class="moz-mime-attachment-header"></fieldset> <pre wrap="" class="moz-quote-pre">_______________________________________________ Shorewall-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/shorewall-users">https://lists.sourceforge.net/lists/listinfo/shorewall-users</a> </pre> </blockquote> </body> </html> --------------bxDnBq35nMw0XPZ1wUZeL4g2-- --===============7454074324707694749== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7454074324707694749== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline