v0.2.9

shorewall-nft 0.2.9 is mostly configuration-compatibility fixes found while a user checked existing iptables configs against it, plus the AutoBL auto-blacklist action.

Configuration compatibility

• A per-interface sysctl for a VLAN interface (enp2s0.10) is written with / separators, so sysctl does not split the dotted name into a .../conf/enp2s0/10/... path (#17).
• REDIRECT accepts a service name in the DEST port, like REDIRECT net ssh tcp 28534; nft resolves it against /etc/services (#18).
• A mangle rule with the firewall zone as its source goes in the output chain, matching upstream, instead of being rejected as an address (#19).
• A snat DEST written interface::address (a double colon, upstream's way to give a destination address with no interface alias) parses cleanly instead of emitting a stray colon (#20).
• The blrules SOURCE and DEST columns accept a comma-separated zone list, the same as the rules file, including a trailing zone:address list (#22).

Conntrack helper on a rule

A per-rule {HELPER=name} option assigns a conntrack helper, for example ACCEPT vm $FW udp 69,4011 {HELPER=tftp} so TFTP's data channel is tracked. It was silently dropped before, so the helper never applied (#23).

AutoBL

The AutoBL action auto-blacklists a source that opens more than a configured number of connections in an interval. Upstream builds it from the recent module and connection events; nft does it directly with a dynamic timed set and a rate meter, so it is native. AutoBL(SSH,60,5,2,300,DROP,warn) wifi $FW tcp 22 accepts normal SSH and, when a source exceeds 5 connections in 60 seconds, adds it to a blacklist set and drops it for 300 seconds. It is refused with a located error on an nft too old for the meter and dynamic-set support (0.9.0).