feat: HostFirewallMixin, a Linux host's own netfilter rules (NetOrk/netork#1344) #51

2026-10-21T21:10:58Z

christianmanivong commented

2026-10-21 21:10:58 +00:00

For NetOrk/netork#1344: whether a container's port is reachable from the internet is also decided by the host's own firewall.

get_host_firewall() reads nft -j list ruleset as root; the tables iptables-nft manages come from iptables-save, because nft shows -m conntrack/-m set only as an opaque xt. A legacy iptables is kept beside nft's tables.
One shape: chains with family, table, hook, priority, policy; rules as matches (iifname, saddr, dport, ct_state, …) and a verdict. A condition not modelled is an unknown match with its text.
No root, no reading: HostFirewallUnavailable.
Checked against edge-gw's real ruleset (only the ipset and addrtype matches stay unknown).

Version 4.21.0. Prio: P3 (as netOrk #1344).

For NetOrk/netork#1344: whether a container's port is reachable from the internet is also decided by the host's own firewall. - `get_host_firewall()` reads `nft -j list ruleset` as root; the tables iptables-nft manages come from `iptables-save`, because nft shows `-m conntrack`/`-m set` only as an opaque `xt`. A legacy iptables is kept beside nft's tables. - One shape: chains with family, table, hook, priority, policy; rules as matches (`iifname`, `saddr`, `dport`, `ct_state`, …) and a verdict. A condition not modelled is an `unknown` match with its text. - No root, no reading: `HostFirewallUnavailable`. - Checked against edge-gw's real ruleset (only the ipset and `addrtype` matches stay `unknown`). Version 4.21.0. Prio: P3 (as netOrk #1344).

christianmanivong added 1 commit 2026-10-21 21:10:58 +00:00

feat: HostFirewallMixin, a Linux host's own netfilter rules (NetOrk/netork#1344 )

CI / test (3.10) (push) Successful in 40s

Details

CI / test (3.11) (push) Successful in 25s

Details

CI / test (3.12) (push) Successful in 25s

Details

CI / test (3.13) (push) Successful in 51s

Details

CI / test (3.10) (pull_request) Successful in 24s

Details

CI / test (3.11) (pull_request) Successful in 26s

Details

CI / test (3.12) (pull_request) Successful in 27s

Details

CI / test (3.13) (pull_request) Successful in 25s

Details

f77091c489

get_host_firewall() reads `nft -j list ruleset` as root and returns every
chain with its family, table, hook, priority and policy, and every rule as
matches and a verdict. Rules iptables-nft wrote show their extensions in nft's
JSON only as an opaque `xt`, so the tables iptables manages are taken from
iptables-save instead; a legacy iptables is kept beside nft's tables, since
both apply. A condition the parse does not model is an `unknown` match with
its text, never left out. Without root neither tool can be read, and
HostFirewallUnavailable is raised rather than a host without rules.

A driver supplies only _run_host_firewall_command(command, privileged=).
Version 4.21.0.

christianmanivong merged commit ac8e7c4c11 into main

2026-10-21 21:26:36 +00:00

christianmanivong deleted branch feat/host-firewall-1344

2026-10-21 21:26:36 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-device-types#51