Re: Introducing shorewall-nft

David Watkins <[email protected]> Sun, 26 Jul 2026 21:35:06 +0100
Newsgroups gmane.comp.security.shorewall
Message-ID <CAJzO0N5gaPrSVtrPqJwrQB+Suqkaxha4c_pML=4uyBuWawksaw@mail.gmail.com>
--===============7772334980226904775==
Content-Type: multipart/alternative; boundary="000000000000987e1e0657898baf"

--000000000000987e1e0657898baf
Content-Type: text/plain; charset="UTF-8"

I'm tempted to give it a try.

Is rate limiting on incoming connections supported?  eg. a rule like

REDIRECT        net             <port>              tcp             <port>
          - - 1/min:2

On Sun, 26 Jul 2026 at 18:55, Justin Pryzby <[email protected]> wrote:

> Hi,
>
> I looked at this a bit.  At present, we have only a few shorewall
> instances, and they don't handle anything sophisticated -- multiple
> interfaces with NAT is about all we need right now.
>
> I appreciate that you've elected to preserve shorewall's configuration
> files/interface.  It's so successful and so well-liked that it's
> important to keep it the same.
>
> I hit a couple minor issues:
>
> ./rules -- If the 'net' zone is empty, this will be rejected.  I understand
> that's deliberate, but a behavior change from shorewall(tm).
> DNAT net,loc vm:192.168.122.11 tcp 80,443,5679
> ERROR: DNAT source zone net has no interface or host to match (rules:19)
>
> ./conntrack -- We had an unmodified template file, which failed like
> this.  I moved it out of the way.
>    ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3
>
> Maybe this dir should be protected, for consistency with shorewall?
> drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall
> drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft
>
> It looks like this already handles what we currently need.
> When we do some more upgrades, we'll also want to support DOCKER=yes --
> it's not clear to me if that's implemented yet ?
>
> It'd be great if a more people were to try it out and report back.  I'm
> sure Dave is interested in more feedback, even if it amounts to "X isn't
> supported / didn't work right", it's useful to know what missing
> features are "most wanted".
>
> Thanks for doing this.
>
> Justin
> Shorewall user for ~20 years.
>
> On Sun, Jul 19, 2026 at 02:55:10PM +1000, Dave Kempe wrote:
> > Hi Shorewall people!
> >
> > We (sol1.com.au) have been avid Shorewall users and supporters for
> around
> > 20 years. Wow that is a long time. We have a fleet of managed firewalls
> > that use Shorewall, among other things, to keep many of our customers
> > online and secure. The decline of Shorewall has been "a problem for
> another
> > day" for a long time now, and I finally decided to do something about it.
> >
> > Shorewall-nft is a Python ground up rewrite, specifically to support
> > keeping your shorewall config the same, but it emits pure nftables.
> >
> > https://github.com/sol1/shorewall-nft
> >
> > We are running it on many of our systems already, in fact, these packets
> > are flowing to you over it right now. It was tested and developed
> against a
> > primary fleet of 45 different firewall configs, including all the
> > standard configurations and much of the weirder configurations
> represented.
> >
> > Our aim is to replace Shorewall with shorewall-nft, and continue
> supporting
> > it. Our team has managed custom software and linux firewalls for years,
> and
> > would be honoured to become custodians of this project. Of course we
> > welcome all input, and this is a true Open Source project.
> >
> > We would love some feedback on whether it works for you. You can simply
> > grab the deb or rpm, do  a shorewall check and shorewall migrate, and it
> > will flush your old rules and switch you to nftables.
> >
> > As bonus features, we also built shorewall-lsm, a Link Status Monitor
> with
> > multi-ISP support that appears to be working well and geoip improvements
> > along they way. Any improvements maintain backwards config capability,
> and
> > simply add to the existing config base.
> > See https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md for
> > more info on shorewall-lsm
> >
> > Happy to provide support or see FRs via github infrastructure. If the
> > project gets legs at all, we will consider a docs site or other further
> > improvements.
>
>
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>

--000000000000987e1e0657898baf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I&#39;m tempted to give it a try.<div><br></div><div>Is ra=
te limiting on incoming connections supported?=C2=A0 eg. a rule like</div><=
div><br></div><div>REDIRECT =C2=A0 =C2=A0 =C2=A0 =C2=A0net=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;port&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 tcp=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&lt;po=
rt&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 - - 1/min:2</div></div><br>=
<div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"=
gmail_attr">On Sun, 26 Jul 2026 at 18:55, Justin Pryzby &lt;<a href=3D"mail=
to:[email protected]">[email protected]</a>&gt; wrote:<br></div><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:=
1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
I looked at this a bit.=C2=A0 At present, we have only a few shorewall<br>
instances, and they don&#39;t handle anything sophisticated -- multiple<br>
interfaces with NAT is about all we need right now.<br>
<br>
I appreciate that you&#39;ve elected to preserve shorewall&#39;s configurat=
ion<br>
files/interface.=C2=A0 It&#39;s so successful and so well-liked that it&#39=
;s<br>
important to keep it the same.<br>
<br>
I hit a couple minor issues:<br>
<br>
./rules -- If the &#39;net&#39; zone is empty, this will be rejected.=C2=A0=
 I understand<br>
that&#39;s deliberate, but a behavior change from shorewall(tm).<br>
DNAT net,loc vm:192.168.122.11 tcp 80,443,5679<br>
ERROR: DNAT source zone net has no interface or host to match (rules:19)<br=
>
<br>
./conntrack -- We had an unmodified template file, which failed like<br>
this.=C2=A0 I moved it out of the way.<br>
=C2=A0 =C2=A0ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3<br>
<br>
Maybe this dir should be protected, for consistency with shorewall?<br>
drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall<br>
drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft<br>
<br>
It looks like this already handles what we currently need.<br>
When we do some more upgrades, we&#39;ll also want to support DOCKER=3Dyes =
--<br>
it&#39;s not clear to me if that&#39;s implemented yet ?<br>
<br>
It&#39;d be great if a more people were to try it out and report back.=C2=
=A0 I&#39;m<br>
sure Dave is interested in more feedback, even if it amounts to &quot;X isn=
&#39;t<br>
supported / didn&#39;t work right&quot;, it&#39;s useful to know what missi=
ng<br>
features are &quot;most wanted&quot;.<br>
<br>
Thanks for doing this.<br>
<br>
Justin<br>
Shorewall user for ~20 years.<br>
<br>
On Sun, Jul 19, 2026 at 02:55:10PM +1000, Dave Kempe wrote:<br>
&gt; Hi Shorewall people!<br>
&gt; <br>
&gt; We (<a href=3D"http://sol1.com.au" rel=3D"noreferrer" target=3D"_blank=
">sol1.com.au</a>) have been avid Shorewall users and supporters for around=
<br>
&gt; 20 years. Wow that is a long time. We have a fleet of managed firewall=
s<br>
&gt; that use Shorewall, among other things, to keep many of our customers<=
br>
&gt; online and secure. The decline of Shorewall has been &quot;a problem f=
or another<br>
&gt; day&quot; for a long time now, and I finally decided to do something a=
bout it.<br>
&gt; <br>
&gt; Shorewall-nft is a Python ground up rewrite, specifically to support<b=
r>
&gt; keeping your shorewall config the same, but it emits pure nftables.<br=
>
&gt; <br>
&gt; <a href=3D"https://github.com/sol1/shorewall-nft" rel=3D"noreferrer" t=
arget=3D"_blank">https://github.com/sol1/shorewall-nft</a><br>
&gt; <br>
&gt; We are running it on many of our systems already, in fact, these packe=
ts<br>
&gt; are flowing to you over it right now. It was tested and developed agai=
nst a<br>
&gt; primary fleet of 45 different firewall configs, including all the<br>
&gt; standard configurations and much of the weirder configurations represe=
nted.<br>
&gt; <br>
&gt; Our aim is to replace Shorewall with shorewall-nft, and continue suppo=
rting<br>
&gt; it. Our team has managed custom software and linux firewalls for years=
, and<br>
&gt; would be honoured to become custodians of this project. Of course we<b=
r>
&gt; welcome all input, and this is a true Open Source project.<br>
&gt; <br>
&gt; We would love some feedback on whether it works for you. You can simpl=
y<br>
&gt; grab the deb or rpm, do=C2=A0 a shorewall check and shorewall migrate,=
 and it<br>
&gt; will flush your old rules and switch you to nftables.<br>
&gt; <br>
&gt; As bonus features, we also built shorewall-lsm, a Link Status Monitor =
with<br>
&gt; multi-ISP support that appears to be working well and geoip improvemen=
ts<br>
&gt; along they way. Any improvements maintain backwards config capability,=
 and<br>
&gt; simply add to the existing config base.<br>
&gt; See <a href=3D"https://github.com/sol1/shorewall-nft/blob/main/docs/fa=
ilover.md" rel=3D"noreferrer" target=3D"_blank">https://github.com/sol1/sho=
rewall-nft/blob/main/docs/failover.md</a> for<br>
&gt; more info on shorewall-lsm<br>
&gt; <br>
&gt; Happy to provide support or see FRs via github infrastructure. If the<=
br>
&gt; project gets legs at all, we will consider a docs site or other furthe=
r<br>
&gt; improvements.<br>
<br>
<br>
_______________________________________________<br>
Shorewall-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">=
[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/shorewall-users" re=
l=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/list=
info/shorewall-users</a><br>
</blockquote></div>

--000000000000987e1e0657898baf--


--===============7772334980226904775==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============7772334980226904775==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline