Lets talk about firewall4 (default nftables firewall)

Two nice to have from me, although I doubt desirable to the project, is always emitting the dstnat/srcnat chains even if no rules are present, and bringing back the user rules chains.
This makes the firewall a bit uglier with lots of empty chains but it does make things more clear for an idiot like me.

I know the advice is to make my own chains with priority-1 however this causes weird interactions with verdicts.
No this is not (easily) implementable via the rule pre/post-pend options as I then have to dynamically find all the chains, zones, devices etc.

Don’t know if it meets what you were looking for to add to the list.

Patch:
https://raw.githubusercontent.com/ericpaulbishop/gargoyle/refs/heads/nftables/patches-generic/010-firewall4_fw3_chains_rules.patch

Both options are defaulted off and available via firewall.defaults options always_emit_nat_zones and emit_user_rule_chains

1 Like