- Introduce a new `fw4 [-q] check` command which tests the rendered ruleset
using nftables' --check mode. This is useful to assert complex rulesets
using external includes for correctness.
- Extend the `fw4 restart` command to check the rendered ruleset before
flushing the existing ruleset.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
flush
;;
restart)
+ QUIET=1 print | nft ${VERBOSE} -c -f $STDIN || die "The rendered ruleset contains errors, not doing firewall restart."
stop || rm -f $STATE
start
;;
+ check)
+ if [ -n "$QUIET" ]; then
+ exec 1>/dev/null
+ exec 2>/dev/null
+ fi
+
+ print | nft ${VERBOSE} -c -f $STDIN && echo "Ruleset passes nftables check."
+ ;;
print)
print
;;
Print the rendered ruleset.
+ $0 [-q] check
+
+ Test the rendered ruleset using nftables' check mode without
+ applying it to the running system.
+
+
$0 [-q] network {net}
Print the name of the firewall zone covering the given network.