Thank you Dave! I find this project intriguing, to say the least.
- Robert
On 7/21/2026 6:16:26 PM, Dave Kempe
wrote:
shorewall-nft 0.2.0
A feature release: run shorewall-nft on machines that cannot run the compiler, and bootstrap a firewall on a clean box.
Shorewall Lite
Run a shorewall-nft firewall on a target with no compiler: a small embedded system, an OpenWRT router, anything without Python. A new runtime-only package, shorewall-nft-lite, depends only on nftables and iproute2.
- Compile on a full system with
shorewall compile -e, deploy withshorewall load SYSTEMover ssh, and run it on the target withshorewall-lite(start,stop,reload,restart,status,check).shorecapon the target captures its capabilities so the admin can compile a ruleset that matches that kernel with--caps.- Packages for Debian, Ubuntu, Fedora, RHEL, Arch and OpenWRT.
- See docs/lite.md for running it and docs/distros.md for the per-distro layout.
shorewall init
Bootstrap a clean install, the counterpart to
migrate.
shorewall initwith no arguments runs an interactive wizard: it detects your interfaces, guesses the uplink from the default route, and writes a working starting point (standalone, gateway or three-zone).- Or non-interactively:
shorewall init --gateway --net eth0 --loc eth1.- It keeps SSH to the firewall open so you cannot lock yourself out, never starts the firewall on its own, and refuses to overwrite an existing configuration.
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
-- Robert K Coffman Jr. Info From Data Corp. 3307249000 [email protected]
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
