# ConiFW documentation

Coniferous Firewall (ConiFW) is a command line utility for managing nftables
rules. Rules are managed via zone-based method using yaml configuration. No
specific knowledge of nftables is required, however having a basic understanding
of networking and system administration will help for a smoother experience.

Conifw works in dual-stack mode by design (based on the nftables _inet_ family)
and generally all options should work for both IPv4 and IPv6. For example,
IP addresses of either family can be mixed in a single rule specification (e.g.
source/destination ip specifications) and conifw will automatically generate
separate rules for each address family as required by nftables. Possible
exceptions to this will be documented.

```{admonition} Note
ConiFW *only* supports systems with nftables, and does **not** support or 
interface with iptables in any direct manner. If iptables is a strict
requirement for you, I recommend checking out [Shorewall](https://shorewall.org/)
which is also a more established and fully featured project.
```

```{admonition} Disclaimer
The maintainer assumes no responsibility towards anyone running this software
on their computing environment. Like any other software, ConiFW may contain
errors and/or other flaws which may cause damage your computer and/or network
or put them into risk of intrusion or other malicious activity.

Use this software at your own risk!
```

```{toctree}
:maxdepth: 1
:caption: Contents:

installation
configuration/index
usage/index
```

## ConiFW vs. Shorewall / other similar tools

If you are familiar with Shorewall, you may find that ConiFW has some
similar configuration concepts, although this is a completely new project and
not a fork of Shorewall.

ConiFW is intended to be a very lightweight utility, whereas Shorewall will
allow you to configure more settings than were allowed with just iptables. For
example, ConiFW will not manage the ip forwarding setting on the managed
system since that falls beyond the scope of nftables configuration. Although 
the project scope might expand in the future, no promises are made at this time.

## Contributions and/or usage of AI based development tools

ConiFW has been developed to this point without any AI assistance. I am not
accepting any contributions via pull requests (AI or not) right now since the
project is still in a very early stage of development and I'm still working
out the details of versioning, packaging etc. Bug reports and feature requests
via the project page are fully welcomed though. And obviously you are always
free to fork your own version if you so choose, in accordance to the license.

## Background

I have used Shorewall for many years and I am still a big fan of it, but as
time went on I started looking into nftables, because thats where the world of
linux firewalls seem to be heading towards. I then discovered that sadly
Shorewall does not and probably never will support nftables. Although the
automatic iptables to nftables translation layer works pretty well, it's still
not the same thing as real nftables support.

Also handling IPv4 and IPv6 via separate commands and configs is not an ideal
situation, though still manageable with proper tools (like ansible). After
searching around for a while, I came to realize that the existing options to
replace Shorewall were not quite what I was looking for personally. So I made
a decision to start developing my own nftables based tool. Whether this was a
wise or a foolish decision remains to be seen.

ConiFW is made with a similar approach to Shorewall; zone-based, no active
processes and a relatively simple but still powerful style of configuration.
Another motivation is to improve my own knowledge of nftables, python and
other related technologies in the process. In other words, this project
was conceived to scratch my long standing itch about linux firewall
configuration. And of course, having a personal pet project is always cool,
right?

# License

Conifw is licensed under the GNU Affero General Public License (AGPL),
version 3 or later.