Your message dated Wed, 28 Aug 2019 11:56:06 +0200
with message-id <[email protected]>
and subject line Re: nftables: improvement for nft settings
has caused the Debian Bug report #935857,
regarding nftables: improvement for nft settings
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
935857: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935857
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nftables
Version: 0.9.1-2~bpo10+1
Severity: important
there's a question on where firewall rules are supposed to be stored
when it comes to nft on debian,
A user looking at nft's systemd service will notice that rules are
stored in /etc/nftables.conf
Nftables.conf needs to have the header "#!/usr/sbin/nft -f"
but why not make it simpler for users and instead put the nft command
outside of this file? .conf files are not supposed to store executables
at the header, that's non-intuitive and imho not a good idea.
other distributions simply keep rules only in this file without any
confusing header executable..
this also makes it non-standard , .conf files are not highly not
regarded to be treated as scripting executables...
--- End Message ---
--- Begin Message ---
Control: tags -1 wontfix
On Mon, 26 Aug 2019 20:30:51 -0400 westlake <[email protected]> wrote:
> Package: nftables
> Version: 0.9.1-2~bpo10+1
> Severity: important
>
> there's a question on where firewall rules are supposed to be stored
> when it comes to nft on debian,
>
> A user looking at nft's systemd service will notice that rules are
> stored in /etc/nftables.conf
>
> Nftables.conf needs to have the header "#!/usr/sbin/nft -f"
>
> but why not make it simpler for users and instead put the nft command
> outside of this file? .conf files are not supposed to store executables
> at the header, that's non-intuitive and imho not a good idea.
>
> other distributions simply keep rules only in this file without any
> confusing header executable..
>
> this also makes it non-standard , .conf files are not highly not
> regarded to be treated as scripting executables...
>
>
>
The file extension can be arbitrary, i.e, it will work with either .nft or .conf
or .cnf or whatever. File extension is used here only to help understand which
kind of file is this.
The shebang in the top of the file is to allow you to use those files as
executable scripts, i.e, to run them like "./nftables-ruleset.nft" or "bash
nftables-ruleset.nft".
Debian provides by default a /etc/nftables.conf file which you can use to put
your firewall rules, which is in turn read by the systemd service.
I don't see any actionable here, closing bug now.
Thanks for the report though!.
--- End Message ---
