Feature: firewall
Description
Adds an nftables-based firewall to Garden Linux, controlled by systemd.
What it does
Installs nftables and enables the nftables systemd service so that firewall rules are applied at boot. The default ruleset allows only established/related traffic and inbound SSH (TCP port 22); all outbound and forwarded traffic is permitted. Rules are loaded from drop-in configuration files under /etc/nft.d/, making it easy to extend the ruleset without modifying the base configuration:
IPv4 and IPv6: /etc/nft.d/default.confDefault policy summary:
| Direction | Default |
|---|---|
| Input | Drop (except TCP/22 and established/related) |
| Output | Accept |
| Forward | Accept |
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Enables the nftables systemd service and appends a drop-in include directive to /etc/nftables.conf so that files in /etc/nft.d/ are loaded. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
pkg.include (ref) | Installs nftables. |
file.include/etc/nft.d/default.conf (file.include) | Default nftables ruleset: drops inbound traffic except established/related connections and TCP port 22 (SSH). |
Related features
This feature has no include or exclude relationships.