Usage

ConiFW is activated by running the command conifw and specifying the required action. The different actions are described in more detail below.

Example:

# Print out generated ruleset directly to the console
conifw generate --stdout

You can always view the usage using conifw --help:

$ conifw --help
usage: conifw [-h] [-C CONFIG_PATH] [-d]
              {apply,clear,generate,validate,version} ...

ConiFW CLI Tool

positional arguments:
  {apply,clear,generate,validate,version}
    apply               Apply rules
    clear               Clear rules
    generate            Generate, but do not apply rules
    validate            Validate configuration and generated ruleset
    version             Show version

options:
  -h, --help            show this help message and exit
  -C, --config CONFIG_PATH
                        Path to configuration directory
  -d, --debug           Enable debug logging. This is applied during early
                        program startup and before any configuration has been
                        read. Overrides log level in the configuration file.

Or view help for specific actions with conifw <action> --help:

$ conifw generate --help
usage: conifw generate [-h] [--stdout] [-o FILENAME] [-O]

options:
  -h, --help            show this help message and exit
  --stdout              Write ruleset to stdout
  -o, --filename FILENAME
                        Write ruleset to given filename
  -O, --overwrite       Overwrite existing file

Apply

Generate and apply the ruleset to the running system.

If the main configuration option output / auto_apply is set to False, this will only validate and generate the destination file but will not automatically load in into the running system. The ruleset may then be processed later by some other means, e.g. during reboot or when the nftables service is restarted.

This action may require root permissions.

Clear

Remove tables generated by ConiFW from the nftables running ruleset.

Note

The configuration option auto_clear must be first set to true for this action to work. ConiFW will also produce a notification about this.

Also worth noting, that the clear action will not modify the on-disk version of the ruleset which may then be reapplied if the system reboots or the nftables service is restarted (in case you have configured the output file as /etc/nftables.conf)

This action may require root permissions.

Generate

This action generates the configuration but does not apply it automatically. If used with the --filename <filename> option, you are able to generate the rules on one host and then transfer them to another host via whatever method you wish. This also means you can manage the rules for multiple remote hosts using only one instance of conifw, using separate configuration files/directories. See the configuration documentation for more details on how to use multiple configurations.

Note

Simply running conifw generate without any parameters will not produce any output (screen nor file). You will need to specify one or more of the options below to be able to view the generated configuration.

Options

-o / --filename)

Write the generated configuration to the indicated file name. An existing file will not be replaced unless -O / --overwrite is specified.

--stdout

This option will produce the generated configuration to standard output.

Both options can be used together for generating the file and displaying the output on screen at the same time.

Validate

The validate action will process the configuration, validate the ruleset with nftables without activating it (nft -c) and then exit the program.

It is useful for checking for any immediately obvious configuration errors or potential errors in the generated ruleset.

This action may require root permissions.

Version

This action prints out the current version and exits the program.

Optional parameters for all actions

-C / --config

This parameter specifies an alternative location for the main configuration file. See configuration for more explanation.

-d / --debug

This will make conifw log a great deal of debug information to the console. It’s not beneficial in normal use, but may be helpful in resolving some error situations.

Furthermore, specifying this parameter on the command line will enable debug logging earlier than just changing the level in the main configuration file.