The following might be interesting for #1125886: ----- Forwarded message from b2cc <[email protected]> -----
From: b2cc <[email protected]> Subject: Re: [firehol/firehol] Move to new iptables-nft interface (#352) Date: Fri, 06 Nov 2026 08:41:26 -0800 b2cc left a comment (firehol/firehol#352) For those still using `firehol` I've created an updated variant that natively works with netfilter / `nft`. Since this repo doesn't seem to be maintained anymore, and some of the changes came out of an LLM, I didn't create a PR but have uploaded it here: https://git.dest-unreachable.net/d-u.net/firehol-nft/src/branch/4.0.0-nft/ Just set the new env `FIREHOL_BACKEND="nft"` in `firehol-defaults.conf`, no other changes needed. Some of the original functionality doesn't work (e.g. `nofast`) since `nft` always atomically applies the whole ruleset. the script will however warn in such cases. Also, a `debug` option has been added that works root-less and dumps the generated ruleset for preview. The `try` option also still works with the nft backend in case the generated ruleset breaks remote connections to deactivate the firewall after some time unless `commit` is typed at the prompt. I've tried to reproduce several, more complicated firewall, port forward and NAT layouts, and the script seems to work as before. I'd be happy about additional test cases though to ensure all functionality is preserved correctly. @jgmbenoit : I have no idea about the debian bug or packaging, but if you want re-introduce it to Debian feel free to grab the source from my repo. As far as I can tell the build should still work without any additional changes or updates. ----- End forwarded message -----
