Re: Introducing shorewall-nft

Hi,

I looked at this a bit.  At present, we have only a few shorewall
instances, and they don't handle anything sophisticated -- multiple
interfaces with NAT is about all we need right now.

I appreciate that you've elected to preserve shorewall's configuration
files/interface.  It's so successful and so well-liked that it's
important to keep it the same.

I hit a couple minor issues:

./rules -- If the 'net' zone is empty, this will be rejected.  I understand
that's deliberate, but a behavior change from shorewall(tm).
DNAT net,loc vm:192.168.122.11 tcp 80,443,5679
ERROR: DNAT source zone net has no interface or host to match (rules:19)

./conntrack -- We had an unmodified template file, which failed like
this.  I moved it out of the way.
   ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3

Maybe this dir should be protected, for consistency with shorewall?
drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall
drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft

It looks like this already handles what we currently need.
When we do some more upgrades, we'll also want to support DOCKER=yes --
it's not clear to me if that's implemented yet ?

It'd be great if a more people were to try it out and report back.  I'm
sure Dave is interested in more feedback, even if it amounts to "X isn't
supported / didn't work right", it's useful to know what missing
features are "most wanted".

Thanks for doing this.

Justin
Shorewall user for ~20 years.

On Sun, Jul 19, 2026 at 02:55:10PM +1000, Dave Kempe wrote:
> Hi Shorewall people!
> 
> We (sol1.com.au) have been avid Shorewall users and supporters for around
> 20 years. Wow that is a long time. We have a fleet of managed firewalls
> that use Shorewall, among other things, to keep many of our customers
> online and secure. The decline of Shorewall has been "a problem for another
> day" for a long time now, and I finally decided to do something about it.
> 
> Shorewall-nft is a Python ground up rewrite, specifically to support
> keeping your shorewall config the same, but it emits pure nftables.
> 
> https://github.com/sol1/shorewall-nft
> 
> We are running it on many of our systems already, in fact, these packets
> are flowing to you over it right now. It was tested and developed against a
> primary fleet of 45 different firewall configs, including all the
> standard configurations and much of the weirder configurations represented.
> 
> Our aim is to replace Shorewall with shorewall-nft, and continue supporting
> it. Our team has managed custom software and linux firewalls for years, and
> would be honoured to become custodians of this project. Of course we
> welcome all input, and this is a true Open Source project.
> 
> We would love some feedback on whether it works for you. You can simply
> grab the deb or rpm, do  a shorewall check and shorewall migrate, and it
> will flush your old rules and switch you to nftables.
> 
> As bonus features, we also built shorewall-lsm, a Link Status Monitor with
> multi-ISP support that appears to be working well and geoip improvements
> along they way. Any improvements maintain backwards config capability, and
> simply add to the existing config base.
> See https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md for
> more info on shorewall-lsm
> 
> Happy to provide support or see FRs via github infrastructure. If the
> project gets legs at all, we will consider a docs site or other further
> improvements.