Basic firewall using nftables #193

New issue

Open

opened 2026-04-11 07:37:28 +00:00 by fhdk · 5 comments

fhdk commented

2026-04-11 07:37:28 +00:00

(Migrated from gitlab2.manjaro.org)

No description provided.

fhdk commented

2026-04-11 07:37:28 +00:00

(Migrated from gitlab2.manjaro.org)

set status to To do

set status to **To do**

fhdk commented

2026-04-11 07:46:34 +00:00

(Migrated from gitlab2.manjaro.org)

nftables has become the defacto standard, I suggest use it as default.

Add nftables to shared/Packages-Root
profiles.conf in enable_systemd configuration item
Switching profiles currently providing ufw to use nftables instead

Documentation

Document the change using a forum topic
For advanced use direct users to firewalld instead of ufw

`nftables` has become the defacto standard, I suggest use it as default. - [ ] Add `nftables` to `shared/Packages-Root` - [ ] `profiles.conf` in `enable_systemd` configuration item - [ ] Switching profiles currently providing `ufw` to use `nftables` instead Documentation - [ ] Document the change using a forum topic - [ ] For advanced use direct users to `firewalld` instead of `ufw`

yochananmarqos1 commented

2026-04-11 13:20:28 +00:00

(Migrated from gitlab2.manjaro.org)

Default as opposed to what? iptables now depends on nftables and ufw depends on iptables. All ISO profiles currently ship gufw.

Default as opposed to what? `iptables` [now depends](https://archlinux.org/news/iptables-now-defaults-to-the-nft-backend/) on `nftables` and `ufw` depends on `iptables`. All ISO profiles currently ship `gufw`.

fhdk commented

2026-04-17 07:30:25 +00:00

(Migrated from gitlab2.manjaro.org)

Not all ISO - plasma does not.

Excerpt from pamac info nftables

Depends On            : glibc gmp jansson libmnl libnftnl readline
Optional Dependencies : python: Python bindings [Installed]
                        python-jsonschema: Python bindings [Installed]
Required By           : criu dnsmasq iptables netavark python-firewall

Defining nftables in Packages-Root will not interfere with current profiles, it simply means that a nftables firewall is available no matter the profile maintainers preference.

If we look at the ISO from ground and up, it becomes clear the Packages-Root can be improved by adding nftables and subsequently in the profile adding the nftables to the enable_systemd configuration.

This will ensure that any and all profiles comes with nftables as part of the base system as defined by Packages-Root and by adding the service to the profile.conf.example template, those building from a from scratch profile will have a basic firewall enabled when booting the ISO.

Packages-Root
Packages-Live
Packages-Desktop

The Packages-Desktop contains ufw and/or gufw - you are correct that by dependency nftables will be pulled onto systems defining ufw - excluding kde profile - and adding it to Packages-Root simply means the dependency is already satisfied when the desktop file system is build.

I am not saying that you should change those profiles you maintain - I merely suggest that we put into place the pieces required to ensure that an ISO based on the profile template has the configuration for a basic firewall enabled.

I remember - years ago - a number of forum topics complaining that Manjaro didn't provide a firewall application right from installation - I reckon those are the reason for adding gufw - but if it is possible to achieve a system that is default protected by using nftables.service it makes sense to simplify the simplify the final installation to use and invisible firewall by activating nftables.

What I mean is the option of delivering a secure system with fewer packages is worth considering (ufw - even the service is enabled - the firewall is not active - it requires the user to flip a switch in the UI).

Not all ISO - plasma does not. Excerpt from `pamac info nftables` ``` Depends On : glibc gmp jansson libmnl libnftnl readline Optional Dependencies : python: Python bindings [Installed] python-jsonschema: Python bindings [Installed] Required By : criu dnsmasq iptables netavark python-firewall ``` Defining `nftables` in `Packages-Root` will not interfere with current profiles, it simply means that a `nftables` firewall is available no matter the profile maintainers preference. If we look at the ISO from ground and up, it becomes clear the Packages-Root can be improved by adding `nftables` and subsequently in the profile adding the `nftables` to the `enable_systemd` configuration. This will ensure that any and all profiles comes with `nftables` as part of the base system as defined by `Packages-Root` and by adding the service to the `profile.conf.example` template, those building from a from scratch profile will have a basic firewall enabled when booting the ISO. - Packages-Root - Packages-Live - Packages-Desktop The `Packages-Desktop` contains `ufw` and/or `gufw` - you are correct that by dependency `nftables` will be pulled onto systems defining `ufw` - excluding kde profile - and adding it to `Packages-Root` simply means the dependency is already satisfied when the desktop file system is build. I am not saying that you should change those profiles you maintain - I merely suggest that we put into place the pieces required to ensure that an ISO based on the profile template has the configuration for a basic firewall enabled. I remember - years ago - a number of forum topics complaining that Manjaro didn't provide a firewall application right from installation - I reckon those are the reason for adding `gufw` - but if it is possible to achieve a system that is default protected by using `nftables.service` it makes sense to simplify the *simplify* the final installation to use and `invisible` firewall by activating `nftables`. What I mean is the option of delivering a secure system with fewer packages is worth considering (ufw - even the service is enabled - the firewall is not active - it requires the user to flip a switch in the UI).

yochananmarqos1 commented

2026-04-19 19:00:08 +00:00

(Migrated from gitlab2.manjaro.org)

My point is we already have a ~~basic~~ uncomplicated firewall using nftables with an easy GUI. Are we really simplifying things? Are we making anything easier for users?

My point is we already have a ~~basic~~ uncomplicated firewall using `nftables` with an easy GUI. Are we really simplifying things? Are we making anything easier for users?