Re: Introducing shorewall-nft

--===============5840257938599197687==
Content-Type: multipart/alternative; boundary="000000000000081d1606578b4d84"

--000000000000081d1606578b4d84
Content-Type: text/plain; charset="UTF-8"

On Mon, 27 Jul 2026 at 03:55, Justin Pryzby <[email protected]> wrote:

>
> I appreciate that you've elected to preserve shorewall's configuration
> files/interface.  It's so successful and so well-liked that it's
> important to keep it the same.
>
>
Preservation of the config structure is a primary goal, please continue to
report any divergence.
Its a bit of  challenge, but i'm happy to keeping pushing to get the
compatibility 100%.



> I hit a couple minor issues:
>
> ./rules -- If the 'net' zone is empty, this will be rejected.  I understand
> that's deliberate, but a behavior change from shorewall(tm).
> DNAT net,loc vm:192.168.122.11 tcp 80,443,5679
> ERROR: DNAT source zone net has no interface or host to match (rules:19)
>
>
Fixed in next release



> ./conntrack -- We had an unmodified template file, which failed like
> this.  I moved it out of the way.
>    ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3
>
>

Should have already been fixed? This was found and fixed in version. 0.1.5.



> Maybe this dir should be protected, for consistency with shorewall?
> drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall
> drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft
>
>
Fixed in next release


> It looks like this already handles what we currently need.
> When we do some more upgrades, we'll also want to support DOCKER=yes --
> it's not clear to me if that's implemented yet ?
>
>
DOCKER=yes is implemented. Its better IMO - make sure your docker is
outputing nftables (so you may need to check versions)

https://github.com/sol1/shorewall-nft/blob/main/docs/design/docker.md

Please try it out and let me know if that works for you.



> It'd be great if a more people were to try it out and report back.  I'm
> sure Dave is interested in more feedback, even if it amounts to "X isn't
> supported / didn't work right", it's useful to know what missing
> features are "most wanted".
>
>
Absolutely.  I'm happy to take config files and whatever errors you have.

Dave

--000000000000081d1606578b4d84
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, 27 Jul =
2026 at 03:55, Justin Pryzby &lt;<a href=3D"mailto:[email protected]">pr=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote=
" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);=
padding-left:1ex"><br>
I appreciate that you&#39;ve elected to preserve shorewall&#39;s configurat=
ion<br>
files/interface.=C2=A0 It&#39;s so successful and so well-liked that it&#39=
;s<br>
important to keep it the same.<br>
<br></blockquote><div><br></div><div>Preservation=C2=A0of the config struct=
ure is a primary goal, please continue to report any divergence.<br></div><=
div>Its a bit of=C2=A0 challenge, but i&#39;m happy to keeping pushing to g=
et the compatibility 100%.</div><div><br></div><div>=C2=A0</div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex">
I hit a couple minor issues:<br>
<br>
./rules -- If the &#39;net&#39; zone is empty, this will be rejected.=C2=A0=
 I understand<br>
that&#39;s deliberate, but a behavior change from shorewall(tm).<br>
DNAT net,loc vm:192.168.122.11 tcp 80,443,5679<br>
ERROR: DNAT source zone net has no interface or host to match (rules:19)<br=
>
<br></blockquote><div><br></div><div>Fixed in next release</div><div><br></=
div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px =
0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
./conntrack -- We had an unmodified template file, which failed like<br>
this.=C2=A0 I moved it out of the way.<br>
=C2=A0 =C2=A0ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3<br>
<br></blockquote><div><br></div><div><br></div><div>Should have already bee=
n fixed? This was found and fixed in version. 0.1.5.</div><div></div><div><=
br></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"=
>
Maybe this dir should be protected, for consistency with shorewall?<br>
drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall<br>
drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft<br>
<br></blockquote><div><br></div><div>Fixed in next release</div><div>=C2=A0=
</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex">
It looks like this already handles what we currently need.<br>
When we do some more upgrades, we&#39;ll also want to support DOCKER=3Dyes =
--<br>
it&#39;s not clear to me if that&#39;s implemented yet ?<br>
<br></blockquote><div><br></div><div>DOCKER=3Dyes is implemented. Its bette=
r IMO - make sure your docker is outputing nftables (so you may need to che=
ck versions)</div><div><br></div><div><a href=3D"https://github.com/sol1/sh=
orewall-nft/blob/main/docs/design/docker.md">https://github.com/sol1/shorew=
all-nft/blob/main/docs/design/docker.md</a></div><div><br></div><div>Please=
 try it out and let me know if that works for you.</div><div><br></div><div=
>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px =
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
It&#39;d be great if a more people were to try it out and report back.=C2=
=A0 I&#39;m<br>
sure Dave is interested in more feedback, even if it amounts to &quot;X isn=
&#39;t<br>
supported / didn&#39;t work right&quot;, it&#39;s useful to know what missi=
ng<br>
features are &quot;most wanted&quot;.<br><br></blockquote><div><br></div><d=
iv>Absolutely.=C2=A0 I&#39;m happy to take config files and whatever errors=
 you have.=C2=A0=C2=A0</div><div><br></div><div>Dave</div></div></div>

--000000000000081d1606578b4d84--


--===============5840257938599197687==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============5840257938599197687==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline