Skip to content

v1.0.16 — ZimaOS 1.6.2 (nf_tables) compatibility + DOCKER-USER port-scoped default-deny

Choose a tag to compare

View all tags
@chicohaager chicohaager released this 09 Jul 19:07
v1.0.16
8f4d18b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

🔴 ZimaOS 1.6.2 compatibility (important). 1.6.2 switches the default iptables backend from legacy to nf_tables; Docker now installs its FORWARD/DOCKER-USER chains under nft. Earlier builds resolved iptables-legacy unconditionally and wrote every rule into the now-unused legacy table — the tile stayed green and reported "firewall applied" while nothing was actually filtered. ZFW now detects the backend Docker actually uses (nft on ≥1.6.2, legacy on ≤1.6.1) and writes there. If you updated to 1.6.2, re-run the installer and verify with iptables-nft -S DOCKER-USER (empty = you were affected).

🛡️ DOCKER-USER default-deny scoped per published port. The catch-all previously dropped only LAN-sourced traffic, so any other origin (a second VLAN routed without SNAT, a port-forwarded service, a ZeroTier route) fell through to the stock RETURN and reached every published container port. NEW inbound to a published port that matches no allow rule is now dropped regardless of source; container egress (different ctorigdstport) and inter-container flows are returned first, so they're untouched.

♻️ Survives dockerd restarts. zfw.service gained PartOf=docker.service — a Docker restart flushes DOCKER-USER, and ZFW now re-applies automatically instead of silently losing its published-port rules until the next boot.

🧪 CI. Fixed the //go:embed openapi.yaml failure across the lint/test/vuln jobs and the multi-arch reproducibility SHA check.

Install / upgrade

scp zfw-1.0.16-amd64.tar.gz <user>@<host>:/tmp/
# on the host:
tar xzf /tmp/zfw-1.0.16-amd64.tar.gz -C /tmp && cd /tmp/zfw-1.0.16-amd64
sudo sh install.sh          # re-running upgrades in place

Note: ZimaOS 1.6.2 disables root SSH by default, so log in as your own user and use sudo. arm64 build attached as well; each tarball ships with a .sha256.

Changes since v1.0.14.

Assets 6
Loading