shorewall-nft 0.3.0 adds the configuration-file man pages, bundles the sample configurations, ships a skeleton /etc/shorewall on a fresh install, and adds a remote deploy and check path for Shorewall Lite. It also proves the ipsec zone match against a live SA.
Man pages and samples
The shorewall-*(5) manual pages are here. shorewall-rules, shorewall-zones and the rest are generated from Shorewall's own DocBook, so they read like upstream, with shorewall-nft notes added where a setting maps to a specific nftables construct. Annotating every construct is still in progress; a page without a note is still an accurate reference for the file format, because shorewall-nft reads the identical files. The command reference, man shorewall, documents the verbs that are ours: init, load and reload to a lite target, monitor, automate, savesets, and the provider verbs. The Shorewall sample topologies are bundled under /usr/share/shorewall-nft/samples.
A configuration on a fresh install
A fresh install now has a skeleton /etc/shorewall and /etc/shorewall6: an empty zones, interfaces, policy and rules, and a shorewall.conf with safe defaults, so shorewall check and the other commands have something to read. The package does not own /etc/shorewall. It seeds the skeleton from the deb postinst and the rpm %post one file at a time, only where a file is absent, so an install over an existing configuration, including the Shorewall it replaces, never touches it. A box with no configuration at all reports a located error instead of a traceback.
Remote deploy and check
shorewall load --capture runs shorecap on the target over ssh and compiles against the target's own kernel, so the ruleset matches without a separate capture step. shorewall check -r validates a configuration against a remote Shorewall Lite target's kernel: it compiles here, copies the firewall to the target, and runs its check there, loading nothing. After a successful load the redundant check suggestion is gone (#25, #26, #27).
IPSEC zone
The ipsec zone match is proven end to end against a live xfrm SA in the test harness. The tunnels file opens IKE and ESP to the peer, so the arriving ESP is accepted and the kernel decrypts it, and the decrypted traffic then matches the zone by reqid. Without the tunnels entry the firewall would drop the ESP before it could be decrypted, which is why an ipsec zone needs it.