Skip to content

v0.2.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Jul 01:16
· 19 commits to main since this release
v0.2.8
c6d3d98

shorewall-nft 0.2.8 fixes a boot-ordering regression, adds more native standard actions, and closes three configuration-compatibility gaps a user hit checking iptables configs.

The boot fix (#16)

The firewall now starts after the network is online, matching upstream shorewall. It ordered before the network before, so a configuration with provider routing or a routes file failed at boot: those routes reference nexthops on interfaces that were not up yet, and the kernel rejected them with "Device for nexthop is not up". The systemd units and the OpenRC init order after network-online now.

Standard actions

More of actions.std is native nftables.

  • The TCP-flag actions TCPFlags, RST, FIN, NotSyn, dropNotSyn and rejNotSyn match tcp flags, and A_REJECT audits then rejects.
  • DropSmurfs drops a broadcast or multicast source, DropDNSrep drops late DNS replies, and GlusterFS opens the GlusterFS ports.
  • Limit and BLACKLIST, which need features not built yet, now fail with a located error naming the action instead of the generic one. Limit points at the RATE LIMIT column, which upstream recommends over it.

Configuration compatibility

  • ?INCLUDE is accepted as the directive spelling of INCLUDE.
  • A params file that uses old-style backtick command substitution is sourced through the shell, as one using $(...) already was.
  • A maclist entry with no MAC address (a - in the MAC column) verifies by IP alone, the way upstream allows.
Assets 6
Loading