Installation

ConiFW can currently be installed via deb package or pip. Installation is best performed on a host with Debian 13 (trixie) which is the current development target.

Warning

Running ConiFW first time on a new host may render it unreachable if the appropriate rules to allow SSH traffic (for example) are not configured properly. Always ensure you have some out-of-band access to the host, physically or some other way (virtual host console, IPMI, serial, etc.) so you can recover from such situations more easily.

Install via OS package manager

Debian (upcoming)

  1. Download the debian package from latest release: https://codeberg.org/habalux/conifw/releases

  2. Install the package: dpkg -i conifw_x.y_all.deb

  3. Create the directory /etc/conifw and place your configuration files there

  4. If you want to use the systemd service:

    • Enable and start the service: systemctl enable --now conifw

    • Check the service status: systemctl status conifw

  5. If you do not wish to run the service (and possibly keep using the default nftables service):

    1. If you need to persist the ruleset across reboots, ensure that your configuration specified the target file as /etc/nftables.conf

    2. Ensure that the nftables service is enabled: systemctl enable nftables

    3. Then simply run conifw apply to configure nftables any time you wish to (re)generate the ruleset.

Warning

ConiFW will try to detect if the destination file has been previously managed by some other way, and will create a backup copy of the file before overwriting it. The file will then be completely managed by ConiFW; there is no support for custom, or “raw” rules to be included in the same destination file at this time.

Install via pip

ConiFW can be installed using pip, using the git repository as a direct source.

If you want to install or try it out using a virtualenv, first create and activate it:

   python3 -m venv venv
   source venv/bin/activate

Then you can install conifw:

   pip3 install git+https://codeberg.org/habalux/conifw.git@main

Run conifw --help to verify if the installation worked. Then you can move on to configuration.

Notice

Installing via pip will not install the systemd service. It must be added manually if you need it.

Compatibility with other software

In general, ConiFW should not cause issues with other nftables software, assuming that they only manage their own tables and do not try to alter or remove tables generated by ConiFW. ConiFW (by default) creates tables with the prefix conifw which should never collide with other tables and therefore not interfere with rules generated by other software.

Warning

If you need to run other nftables managing software (like docker with its native nftables support) alongside ConiFW, you should test how the combination behaves before putting it into any serious use. The most undesired situation would be if another software does a full “flush ruleset” which might accidentally and completely open up the firewall without warning.

By default, a ruleset file generated by ConiFW will never flush the whole ruleset when applying it to the system, it will only clear and recreate the tables it is responsible for.

Docker

When the docker native nftables support is enabled, ConiFW should not interfere with docker generated rules (see above).

Notice

ConiFW has not been thoroughly tested with docker at this time. Configuration options for more straightforward docker integration will likely be implemented in the future, but in the meantime you can refer to the docker nftables documentation for potentially helpful information.