Is there still any active development on the nftables module ?

[yannickdm]

Dear,

Since IPTables is being decomissioned, is there any active development on the nftables implementation on SaltStack ?
Looking at the source code it seems we have some functionality, but we are missing a lot as well. It was hard to find how to add a prefix, but I managed, by reading the source code and just trying different ways. While in the IPTables modules, this is just a value ;)

Same for limits, looking through the source code, it does not seem available, I might find a way, but so far I haven't.

So in short, is there still any active development on the module for NFtables since this seems to be the successor on iptables. Firewalld and uwf, are on another level and when migrating from iptables, nftables seems to be the way :)

Thanks for your input

[lkubb]

Imho the current approach the nftables modules use is suboptimal (parse stdout) and should be rewritten to use the nft -j JSON output for more reliability (see #62203 (comment)). It's a lot of work though.

Because of the several nftables module shortcomings and the difficulty of resolving them, I opted to write a formula that manages nftables config files instead, which turned out quite reliable and flexible for me:

https://github.com/lkubb/salt-nftables-formula