Re: Introducing shorewall-nft
David Watkins <[email protected]> Sun, 26 Jul 2026 21:35:06 +0100
| Newsgroups | gmane.comp.security.shorewall |
|---|---|
| Message-ID | <CAJzO0N5gaPrSVtrPqJwrQB+Suqkaxha4c_pML=4uyBuWawksaw@mail.gmail.com> |
--===============7772334980226904775==
Content-Type: multipart/alternative; boundary="000000000000987e1e0657898baf"
--000000000000987e1e0657898baf
Content-Type: text/plain; charset="UTF-8"
I'm tempted to give it a try.
Is rate limiting on incoming connections supported? eg. a rule like
REDIRECT net <port> tcp <port>
- - 1/min:2
On Sun, 26 Jul 2026 at 18:55, Justin Pryzby <[email protected]> wrote:
> Hi,
>
> I looked at this a bit. At present, we have only a few shorewall
> instances, and they don't handle anything sophisticated -- multiple
> interfaces with NAT is about all we need right now.
>
> I appreciate that you've elected to preserve shorewall's configuration
> files/interface. It's so successful and so well-liked that it's
> important to keep it the same.
>
> I hit a couple minor issues:
>
> ./rules -- If the 'net' zone is empty, this will be rejected. I understand
> that's deliberate, but a behavior change from shorewall(tm).
> DNAT net,loc vm:192.168.122.11 tcp 80,443,5679
> ERROR: DNAT source zone net has no interface or host to match (rules:19)
>
> ./conntrack -- We had an unmodified template file, which failed like
> this. I moved it out of the way.
> ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3
>
> Maybe this dir should be protected, for consistency with shorewall?
> drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall
> drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft
>
> It looks like this already handles what we currently need.
> When we do some more upgrades, we'll also want to support DOCKER=yes --
> it's not clear to me if that's implemented yet ?
>
> It'd be great if a more people were to try it out and report back. I'm
> sure Dave is interested in more feedback, even if it amounts to "X isn't
> supported / didn't work right", it's useful to know what missing
> features are "most wanted".
>
> Thanks for doing this.
>
> Justin
> Shorewall user for ~20 years.
>
> On Sun, Jul 19, 2026 at 02:55:10PM +1000, Dave Kempe wrote:
> > Hi Shorewall people!
> >
> > We (sol1.com.au) have been avid Shorewall users and supporters for
> around
> > 20 years. Wow that is a long time. We have a fleet of managed firewalls
> > that use Shorewall, among other things, to keep many of our customers
> > online and secure. The decline of Shorewall has been "a problem for
> another
> > day" for a long time now, and I finally decided to do something about it.
> >
> > Shorewall-nft is a Python ground up rewrite, specifically to support
> > keeping your shorewall config the same, but it emits pure nftables.
> >
> > https://github.com/sol1/shorewall-nft
> >
> > We are running it on many of our systems already, in fact, these packets
> > are flowing to you over it right now. It was tested and developed
> against a
> > primary fleet of 45 different firewall configs, including all the
> > standard configurations and much of the weirder configurations
> represented.
> >
> > Our aim is to replace Shorewall with shorewall-nft, and continue
> supporting
> > it. Our team has managed custom software and linux firewalls for years,
> and
> > would be honoured to become custodians of this project. Of course we
> > welcome all input, and this is a true Open Source project.
> >
> > We would love some feedback on whether it works for you. You can simply
> > grab the deb or rpm, do a shorewall check and shorewall migrate, and it
> > will flush your old rules and switch you to nftables.
> >
> > As bonus features, we also built shorewall-lsm, a Link Status Monitor
> with
> > multi-ISP support that appears to be working well and geoip improvements
> > along they way. Any improvements maintain backwards config capability,
> and
> > simply add to the existing config base.
> > See https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md for
> > more info on shorewall-lsm
> >
> > Happy to provide support or see FRs via github infrastructure. If the
> > project gets legs at all, we will consider a docs site or other further
> > improvements.
>
>
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
--000000000000987e1e0657898baf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">I'm tempted to give it a try.<div><br></div><div>Is ra=
te limiting on incoming connections supported?=C2=A0 eg. a rule like</div><=
div><br></div><div>REDIRECT =C2=A0 =C2=A0 =C2=A0 =C2=A0net=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<port>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 tcp=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<po=
rt>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 - - 1/min:2</div></div><br>=
<div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"=
gmail_attr">On Sun, 26 Jul 2026 at 18:55, Justin Pryzby <<a href=3D"mail=
to:[email protected]">[email protected]</a>> wrote:<br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
I looked at this a bit.=C2=A0 At present, we have only a few shorewall<br>
instances, and they don't handle anything sophisticated -- multiple<br>
interfaces with NAT is about all we need right now.<br>
<br>
I appreciate that you've elected to preserve shorewall's configurat=
ion<br>
files/interface.=C2=A0 It's so successful and so well-liked that it'=
;s<br>
important to keep it the same.<br>
<br>
I hit a couple minor issues:<br>
<br>
./rules -- If the 'net' zone is empty, this will be rejected.=C2=A0=
I understand<br>
that's deliberate, but a behavior change from shorewall(tm).<br>
DNAT net,loc vm:192.168.122.11 tcp 80,443,5679<br>
ERROR: DNAT source zone net has no interface or host to match (rules:19)<br=
>
<br>
./conntrack -- We had an unmodified template file, which failed like<br>
this.=C2=A0 I moved it out of the way.<br>
=C2=A0 =C2=A0ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3<br>
<br>
Maybe this dir should be protected, for consistency with shorewall?<br>
drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall<br>
drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft<br>
<br>
It looks like this already handles what we currently need.<br>
When we do some more upgrades, we'll also want to support DOCKER=3Dyes =
--<br>
it's not clear to me if that's implemented yet ?<br>
<br>
It'd be great if a more people were to try it out and report back.=C2=
=A0 I'm<br>
sure Dave is interested in more feedback, even if it amounts to "X isn=
't<br>
supported / didn't work right", it's useful to know what missi=
ng<br>
features are "most wanted".<br>
<br>
Thanks for doing this.<br>
<br>
Justin<br>
Shorewall user for ~20 years.<br>
<br>
On Sun, Jul 19, 2026 at 02:55:10PM +1000, Dave Kempe wrote:<br>
> Hi Shorewall people!<br>
> <br>
> We (<a href=3D"http://sol1.com.au" rel=3D"noreferrer" target=3D"_blank=
">sol1.com.au</a>) have been avid Shorewall users and supporters for around=
<br>
> 20 years. Wow that is a long time. We have a fleet of managed firewall=
s<br>
> that use Shorewall, among other things, to keep many of our customers<=
br>
> online and secure. The decline of Shorewall has been "a problem f=
or another<br>
> day" for a long time now, and I finally decided to do something a=
bout it.<br>
> <br>
> Shorewall-nft is a Python ground up rewrite, specifically to support<b=
r>
> keeping your shorewall config the same, but it emits pure nftables.<br=
>
> <br>
> <a href=3D"https://github.com/sol1/shorewall-nft" rel=3D"noreferrer" t=
arget=3D"_blank">https://github.com/sol1/shorewall-nft</a><br>
> <br>
> We are running it on many of our systems already, in fact, these packe=
ts<br>
> are flowing to you over it right now. It was tested and developed agai=
nst a<br>
> primary fleet of 45 different firewall configs, including all the<br>
> standard configurations and much of the weirder configurations represe=
nted.<br>
> <br>
> Our aim is to replace Shorewall with shorewall-nft, and continue suppo=
rting<br>
> it. Our team has managed custom software and linux firewalls for years=
, and<br>
> would be honoured to become custodians of this project. Of course we<b=
r>
> welcome all input, and this is a true Open Source project.<br>
> <br>
> We would love some feedback on whether it works for you. You can simpl=
y<br>
> grab the deb or rpm, do=C2=A0 a shorewall check and shorewall migrate,=
and it<br>
> will flush your old rules and switch you to nftables.<br>
> <br>
> As bonus features, we also built shorewall-lsm, a Link Status Monitor =
with<br>
> multi-ISP support that appears to be working well and geoip improvemen=
ts<br>
> along they way. Any improvements maintain backwards config capability,=
and<br>
> simply add to the existing config base.<br>
> See <a href=3D"https://github.com/sol1/shorewall-nft/blob/main/docs/fa=
ilover.md" rel=3D"noreferrer" target=3D"_blank">https://github.com/sol1/sho=
rewall-nft/blob/main/docs/failover.md</a> for<br>
> more info on shorewall-lsm<br>
> <br>
> Happy to provide support or see FRs via github infrastructure. If the<=
br>
> project gets legs at all, we will consider a docs site or other furthe=
r<br>
> improvements.<br>
<br>
<br>
_______________________________________________<br>
Shorewall-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">=
[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-users" re=
l=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/list=
info/shorewall-users</a><br>
</blockquote></div>
--000000000000987e1e0657898baf--
--===============7772334980226904775==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============7772334980226904775==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline