feat(firewall): use direct nftables when supported by qdm12 · Pull Request #3157 · passteque/gluetun

qdm12 · 2026-02-25T03:49:55Z

Description

Try it out using image tag :pr-3157 and FIREWALL_IMPLEMENTATION=nftables

New option FIREWALL_IMPLEMENTATION which can be iptables (default) or nftables
When using nftables, it uses kernel calls directly and does not rely on iptables at all.
Add nft cli (100KB extra) to support custom post rules like it is currently with iptables.
Tested out, test there is no leak
Github wiki updated

Later, after v3.42.0 release, change it such that:

If the nftables backend is supported, default to using the nftables implementation. Otherwise, fallback on using iptables.

Issue

…nf_tables

qdm12 · 2026-08-07T11:29:20Z

+		customRulesPath = "/iptables/post-rules.txt"
+	case "nftables":
+		impl = nftables.New(logger)
+		customRulesPath = "/gluetun/firewall/nftables/post-rules.txt"


note: this needs documentation in the github-wiki after this PR gets merged.

qdm12 · 2026-08-07T11:30:14Z

    mv /usr/sbin/openvpn /usr/sbin/openvpn2.5 && \
    apk del openvpn && \
-    apk add --no-cache --update openvpn ca-certificates iptables iptables-legacy tzdata && \
+    apk add --no-cache --update openvpn ca-certificates nftables iptables iptables-legacy tzdata && \


nit: nftables adds 100KB to the image, to be able to run nft commands, worth it imo

Copilot

Pull request overview

Adds a selectable direct nftables firewall backend while retaining iptables support.

Changes:

Adds firewall implementation configuration and wiring.
Implements nftables filtering, NAT, conntrack, custom rules, and rollback.
Updates dependencies, container tooling, callers, and tests.

Reviewed changes

Copilot reviewed 44 out of 45 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Review summary
`internal/pmtud/tcp/tcp_integration_test.go`	Updates firewall construction in integration tests.
`internal/pmtud/tcp/helpers_test.go`	Updates firewall construction helpers.
`internal/pmtud/pmtud_integration_test.go`	Updates PMTUD firewall setup.
`internal/firewall/nftables/version_test.go`	Tests nftables version handling.
`internal/firewall/nftables/unsupported.go`	Provides unsupported-platform behavior.
`internal/firewall/nftables/tcp.go`	Implements nftables TCP rules.
`internal/firewall/nftables/tcp_test.go`	Tests TCP rule generation.
`internal/firewall/nftables/support.go`	Detects support and parses user rules.
`internal/firewall/nftables/support_test.go`	Critical (1 vote): mock expectation does not match the variadic warning arguments.
`internal/firewall/nftables/redirect.go`	Implements redirect rules.
`internal/firewall/nftables/redirect_test.go`	Tests redirect handling.
`internal/firewall/nftables/output.go`	Critical (2 votes): mixed address families are not rejected.
`internal/firewall/nftables/output_test.go`	Tests output rules.
`internal/firewall/nftables/mocks_test.go`	Defines test mocks.
`internal/firewall/nftables/mocks_local_test.go`	Provides local test mocks.
`internal/firewall/nftables/mocks_generate_test.go`	Supports mock generation.
`internal/firewall/nftables/interfaces.go`	Defines nftables interfaces.
`internal/firewall/nftables/interfaces_local.go`	Defines platform-local interfaces.
`internal/firewall/nftables/input.go`	Implements input rules.
`internal/firewall/nftables/input_test.go`	Tests input rule generation.
`internal/firewall/nftables/firewall.go`	Implements nftables firewall lifecycle.
`internal/firewall/nftables/filter.go`	Critical (1 vote): existing user-owned chains may be modified and flushed.
`internal/firewall/nftables/filter_test.go`	Tests filtering behavior.
`internal/firewall/nftables/exprs.go`	Builds nftables expressions.
`internal/firewall/nftables/exprs_test.go`	Tests expression generation.
`internal/firewall/nftables/delete.go`	Implements rule deletion.
`internal/firewall/nftables/delete_test.go`	Tests deletion behavior.
`internal/firewall/nftables/conntrack.go`	Implements conntrack handling.
`internal/firewall/nftables/conntrack_test.go`	Tests conntrack behavior.
`internal/firewall/nftables/basechains.go`	Configures nftables base chains.
`internal/firewall/nftables/basechains_test.go`	Tests base-chain configuration.
`internal/firewall/nftables/atomic.go`	Critical (3 votes): rollback does not restore tracked rules, remove newly created tables, or losslessly preserve unsupported/stateful objects.
`internal/firewall/nftables/atomic_test.go`	Tests atomic operations.
`internal/firewall/iptables/iptables.go`	Refactors iptables policy handling.
`internal/firewall/interfaces.go`	Extends the firewall abstraction.
`internal/firewall/firewall.go`	Selects the configured backend.
`internal/firewall/enable.go`	Configures firewall policy behavior.
`internal/configuration/settings/settings_test.go`	Updates settings expectations.
`internal/configuration/settings/firewall.go`	Defines firewall implementation configuration.
`internal/configuration/settings/firewall_test.go`	Tests firewall setting validation.
`go.sum`	Records dependency checksums.
`go.mod`	Adds the nftables dependency.
`Dockerfile`	Installs nftables tooling.
`cmd/gluetun/main.go`	Passes backend selection to firewall construction.
`.devcontainer/Dockerfile`	Adds nftables development tooling.

Suppressed comments (2)

internal/firewall/nftables/filter.go:39

The new backend is covered only by mocked netlink tests, so the tests do not verify that these expressions are accepted by the target kernel or that the resulting inet filter/NAT rules actually prevent leaks. Add a Linux integration test that exercises packet filtering and enable/restore behavior with the required capabilities before making this backend generally usable.

func setupFilterWithBaseChains(conn conn, policy *nftables.ChainPolicy) (table *nftables.Table,
	inputChain, forwardChain, outputChain *nftables.Chain,
	err error,
) {

internal/firewall/nftables/redirect.go:169

The iptables backend implements this API with REDIRECT, which rewrites the destination to a local address as well as changing the port. This rule uses port-only DNAT, so it leaves the packet addressed to the VPN IP; a service bound only to loopback or another local address will not receive the redirected traffic. Use the nftables redirect to :port expression (expr.Redir) to preserve the existing behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

qdm12 · 2026-08-24T00:32:05Z

+	return func(ctx context.Context) {
+		f.restoreTablesLocked(ctx, tables)
+	}, nil


the restore function now snapshots the tracked rules at save time and resets f.rules to that snapshot, so disable/enable cycles can't double-track rules

qdm12 · 2026-08-24T00:32:12Z

+func restoreTables(conn conn, savedTables []savedTable) error {
+	for _, savedTable := range savedTables {
+		table := conn.AddTable(savedTable.table)


restore now deletes every table that exists but wasn't in the snapshot, so the owned table (and its DROP policy) is removed after disable or a failed enable. Since the backend now owns a dedicated inet gluetun table, this deletes exactly what the backend created; user post rules are re-run at each enable so tables they create are harmlessly removed. Verified with a new kernel integration test (GLUETUN_NFTABLES_INTEGRATION=1)

qdm12 · 2026-08-24T00:32:22Z

+// saveTables saves the state of all the tables, their chains, and their rules.
+func saveTables(conn conn) ([]savedTable, error) {


Addressed structurally: the backend no longer snapshots or re-adds user state — it owns a single dedicated table whose rollback is a plain DelTable (no rule parsing involved), so unknown expressions/sets can't cause a weakened re-add. The remaining snapshot is only used to roll back user post rules, which has the same inherent limitation in iptables mode (iptables-save/restore). A fully lossless CLI-based restore (nft -a list ruleset → nft -f) was considered but conflicts with the direct-netlink design goal of this backend.

qdm12 · 2026-08-24T00:32:30Z

+	ensureChain := func(name string, hooknum *nftables.ChainHook) *nftables.Chain {
+		if chain, ok := existingChains[name]; ok {
+			if policy != nil {
+				chain.Policy = policy
+				conn.AddChain(chain)
+			}


Fixed — the backend now uses a dedicated inet gluetun table with its own chains instead of reusing the conventional inet filter/inet nat tables, so user-owned policies/chains/rules are never modified (this also stops Gluetun's dnat rules from landing in Docker's nat table in iptables-nft containers).

qdm12 · 2026-08-24T00:32:38Z

+	exprs := append(outputInterfaceExprs(intf), sourceIPExprs(source.Addr())...)
+	exprs = append(exprs, destinationIPExprs(destination.Addr())...)


Fixed — both AcceptOutputFromIPPortToIPPort and AcceptOutputFromIPToSubnet (same latent issue) now reject mixed families with the same error the iptables backend returns.

qdm12 · 2026-08-24T00:32:48Z

+
+			ctrl := gomock.NewController(t)
+			mockLogger := NewMockLogger(ctrl)
+			mockLogger.EXPECT().Warnf(gomock.Any(), gomock.Any()).Times(testCase.expectedWarnings)


The tests actually pass as-is: with go.uber.org/mock variadic matching, the last expectation matcher covers the first variadic argument, so Warnf(Any, Any) matches the 3-argument call (see Call.matches in gomock/call.go). That said, the expectation is now precise — it matches the format string, line number, and line text explicitly

… validation - use a dedicated inet gluetun table for all backend chains, so user-defined tables, chains, and rules are never modified - restore removes tables created after the save (no more DROP policy or rule leak after disable), and resets the tracked rules to the saved state (no more double tracking across enable/disable cycles) - remove a stale gluetun table left by a previous crashed session before saving, so the restore does not resurrect it - reject mixed source/destination address families in AcceptOutputFromIPPortToIPPort and AcceptOutputFromIPToSubnet, matching the iptables backend behavior - match the Warnf mock expectation in Test_parseUserRules with the three actual arguments (format, line number, line text) - add a kernel integration test verifying the no-leak restore, skipped unless GLUETUN_NFTABLES_INTEGRATION=1 - gofumpt unsupported.go

qdm12 force-pushed the master branch from d0247a1 to 0eeee5c Compare February 25, 2026 04:24

qdm12 added 4 commits February 28, 2026 15:23

chore(firewall/iptables): modprobe and cache support for xt_mark and …

e87d915

…nf_tables

add nftables to dev container

fa0941a

chore: merge iptables SetIPv4AllPolicies and SetIPv6AllPolicies together

781e74f

wip

cd9ba54

qdm12 force-pushed the nftables branch from 4370076 to cd9ba54 Compare February 28, 2026 22:39

qdm12 force-pushed the master branch from 53bc8fb to d8a3cc3 Compare March 4, 2026 22:54

qdm12 added Category: Firewall ⛓️ Complexity: ☣️ Hard to do Status: 🔒 After next release Will be done after the next release labels Mar 7, 2026

qdm12 force-pushed the master branch 2 times, most recently from 2c06921 to 9a5995f Compare March 16, 2026 13:48

qdm12 force-pushed the master branch from f4a8fc4 to 086e374 Compare March 23, 2026 14:36

qdm12 force-pushed the master branch 4 times, most recently from 40f126b to 44d5104 Compare May 3, 2026 04:29

qdm12 force-pushed the master branch from 3e64b87 to 1a25f73 Compare May 21, 2026 18:32

qdm12 added 7 commits August 2, 2026 15:07

wip ai

113253b

FIREWALL_IMPLEMENTATION option

27b089d

RunUserPostRules uses nft cli

0f337b4

human review!

c513b8f

Merge branch 'master' into nftables

a10285d

moare fixes

c463c56

ai generated tests

ba5942a

qdm12 force-pushed the nftables branch from 38966ee to ba5942a Compare August 7, 2026 11:20

remove unused code

2697b44

qdm12 commented Aug 7, 2026

View reviewed changes

more fixes

3d76b14

qdm12 force-pushed the master branch from 622100b to 7eed6ea Compare August 7, 2026 11:40

Merge branch 'master' into nftables

2eb6478

qdm12 force-pushed the nftables branch from 1dae174 to 2eb6478 Compare August 7, 2026 11:41

qdm12 added 4 commits August 8, 2026 14:19

review pass for tests

b40c7ad

fix unit test in settings package

2fc00ed

wip ai to review

7ad6163

some qwen 3.8 deep thoughts in there

662dd13

qdm12 marked this pull request as ready for review August 19, 2026 18:20

linux build tags

981949e

qdm12 force-pushed the nftables branch from c541d57 to 981949e Compare August 19, 2026 18:39

qdm12 deployed to secrets August 19, 2026 18:44 — with GitHub Actions Active

qdm12 had a problem deploying to secrets August 19, 2026 18:46 — with GitHub Actions Failure

qdm12 had a problem deploying to secrets August 19, 2026 19:41 — with GitHub Actions Failure

fix for 32 bit compilation

2ad9277

qdm12 deployed to secrets August 19, 2026 21:54 — with GitHub Actions Active

qdm12 deployed to secrets August 19, 2026 21:56 — with GitHub Actions Active

qdm12 mentioned this pull request Aug 22, 2026

Feature request: Keep IPv6 address for ProtonVPN servers #3442

Closed

qdm12 added Status: 🟡 Nearly resolved This might be resolved or is about to be resolved and removed Status: 🔒 After next release Will be done after the next release labels Aug 22, 2026

qdm12 requested a lite review from Copilot August 22, 2026 15:24

Copilot started reviewing on behalf of qdm12 August 22, 2026 15:24 View session

Copilot AI reviewed Aug 22, 2026

View reviewed changes

qdm12 deployed to secrets August 24, 2026 00:36 — with GitHub Actions Active

qdm12 deployed to secrets August 24, 2026 00:38 — with GitHub Actions Active

Navigation Menu

Uh oh!

Uh oh!

feat(firewall): use direct nftables when supported - #3157

feat(firewall): use direct nftables when supported#3157
qdm12 wants to merge 21 commits into
masterfrom
nftables

qdm12 commented Feb 25, 2026 •

edited

Loading

Uh oh!

qdm12 Aug 7, 2026 •

edited

Loading

Uh oh!

qdm12 Aug 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

qdm12 Aug 24, 2026

Uh oh!

qdm12 Aug 24, 2026

Uh oh!

qdm12 Aug 24, 2026

Uh oh!

qdm12 Aug 24, 2026

Uh oh!

qdm12 Aug 24, 2026

Uh oh!

qdm12 Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		// saveTables saves the state of all the tables, their chains, and their rules.
		func saveTables(conn conn) ([]savedTable, error) {

		exprs := append(outputInterfaceExprs(intf), sourceIPExprs(source.Addr())...)
		exprs = append(exprs, destinationIPExprs(destination.Addr())...)

Uh oh!

Uh oh!

Conversation

qdm12 commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Uh oh!

qdm12 Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qdm12 Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

qdm12 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

qdm12 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

qdm12 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

qdm12 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

qdm12 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

qdm12 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qdm12 commented Feb 25, 2026 •

edited

Loading

qdm12 Aug 7, 2026 •

edited

Loading

qdm12 Aug 7, 2026 •

edited

Loading