Re: Errors testing migration from SW Iptables to SW Nft

Hi Dave,

On 7/30/26 11:22 PM, Dave Kempe wrote:
> Hi Matt,
> Happy to help out. Can you mention your shorewall-nft version? 

Sorry about that, I forgot to include the SHA1 of the commit I was 
building on.

> I will investigate your report, - building parity with the vast array of 
> shorewall options is a bunch of work and testing.

I appreciate you doing so.
You fixed all of the reported issues and new one will be filed on GH.

> Also feel free to lodge bugs on github: https://github.com/sol1/ 
> shorewall-nft/issues <https://github.com/sol1/shorewall-nft/issues>
> 
> I'm also trying to keep this this authoritative: https://github.com/ 
> sol1/shorewall-nft/blob/main/docs/coverage.md <https://github.com/sol1/ 
> shorewall-nft/blob/main/docs/coverage.md> but it is hard to cover all 
> the combos available.

Like Tom, you are doing a fantastic job maintaining SW-Nft and an 
extensive documentations. I'll be more careful next time by checking 
the docs before reporting issues!

Thanks a bunch.


P.S.

Just FYI for anyone reading this and the archive.

In SW-Iptables, it was possible to do something like:

/etc/shorewall/rules:
?INCLUDE DMZ.rules
/etc/shorewall/shorewall.conf:
CONFIG_PATH="${CONFDIR}/shorewall:${CONFDIR}/shorewall/rules.d:${SHAREDIR}/shorewall"

This `CONFIG_PATH` allowed to include files with a relative path  simply 
by specifying the name of the file and SW-Iptables would look for the 
file in the specified directories (`rules.d` in this case).
Starting with SW-Nft, this is no longer possible as explained at 
https://github.com/sol1/shorewall-nft/blob/main/docs/settings.md#safe-no-ops.

As far as I can tell, they are simply ignored without a weak warning 
while checking SW's config..

-- Matt Darfeuille
-- 
Matt Darfeuille