I'm tempted to give it a try.
Is rate limiting on incoming connections supported? eg. a rule like
REDIRECT net <port> tcp <port>
- - 1/min:2
On Sun, 26 Jul 2026 at 18:55, Justin Pryzby <[email protected]> wrote:
> Hi,
>
> I looked at this a bit. At present, we have only a few shorewall
> instances, and they don't handle anything sophisticated -- multiple
> interfaces with NAT is about all we need right now.
>
> I appreciate that you've elected to preserve shorewall's configuration
> files/interface. It's so successful and so well-liked that it's
> important to keep it the same.
>
> I hit a couple minor issues:
>
> ./rules -- If the 'net' zone is empty, this will be rejected. I understand
> that's deliberate, but a behavior change from shorewall(tm).
> DNAT net,loc vm:192.168.122.11 tcp 80,443,5679
> ERROR: DNAT source zone net has no interface or host to match (rules:19)
>
> ./conntrack -- We had an unmodified template file, which failed like
> this. I moved it out of the way.
> ERROR: /etc/shorewall/conntrack:6: unsupported ?FORMAT 3
>
> Maybe this dir should be protected, for consistency with shorewall?
> drwxr-x--- 2 root root 4096 Jul 20 09:50 /var/lib/shorewall
> drwxr-xr-x 2 root root 4096 Jul 20 09:52 /var/lib/shorewall-nft
>
> It looks like this already handles what we currently need.
> When we do some more upgrades, we'll also want to support DOCKER=yes --
> it's not clear to me if that's implemented yet ?
>
> It'd be great if a more people were to try it out and report back. I'm
> sure Dave is interested in more feedback, even if it amounts to "X isn't
> supported / didn't work right", it's useful to know what missing
> features are "most wanted".
>
> Thanks for doing this.
>
> Justin
> Shorewall user for ~20 years.
>
> On Sun, Jul 19, 2026 at 02:55:10PM +1000, Dave Kempe wrote:
> > Hi Shorewall people!
> >
> > We (sol1.com.au) have been avid Shorewall users and supporters for
> around
> > 20 years. Wow that is a long time. We have a fleet of managed firewalls
> > that use Shorewall, among other things, to keep many of our customers
> > online and secure. The decline of Shorewall has been "a problem for
> another
> > day" for a long time now, and I finally decided to do something about it.
> >
> > Shorewall-nft is a Python ground up rewrite, specifically to support
> > keeping your shorewall config the same, but it emits pure nftables.
> >
> > https://github.com/sol1/shorewall-nft
> >
> > We are running it on many of our systems already, in fact, these packets
> > are flowing to you over it right now. It was tested and developed
> against a
> > primary fleet of 45 different firewall configs, including all the
> > standard configurations and much of the weirder configurations
> represented.
> >
> > Our aim is to replace Shorewall with shorewall-nft, and continue
> supporting
> > it. Our team has managed custom software and linux firewalls for years,
> and
> > would be honoured to become custodians of this project. Of course we
> > welcome all input, and this is a true Open Source project.
> >
> > We would love some feedback on whether it works for you. You can simply
> > grab the deb or rpm, do a shorewall check and shorewall migrate, and it
> > will flush your old rules and switch you to nftables.
> >
> > As bonus features, we also built shorewall-lsm, a Link Status Monitor
> with
> > multi-ISP support that appears to be working well and geoip improvements
> > along they way. Any improvements maintain backwards config capability,
> and
> > simply add to the existing config base.
> > See https://github.com/sol1/shorewall-nft/blob/main/docs/failover.md for
> > more info on shorewall-lsm
> >
> > Happy to provide support or see FRs via github infrastructure. If the
> > project gets legs at all, we will consider a docs site or other further
> > improvements.
>
>
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
>
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
