Modify script to use nft instead of iptables

[billz]

No description provided.

[billz]

QRD:

1. Ran through an Insiders build by modifying Dockerfile, adding --insiders --name --token options
2. Built with docker build -t raspap .
3. Executed docker run --name raspap -it -d --privileged --network=host --cgroupns=host -v /sys/fs/cgroup:/sys/fs/cgroup:rw --cap-add SYS_ADMIN raspap
4. Container status showed Exited (255) - critical error

According to the logs, firewall-rules.sh throws iptables errors:

$ docker logs raspap
iptables: No chain/target/match by that name.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Mar 21 13:26:15 2025

Replacing these with nftables resolves this. @NL-TCH thoughts?

kernel version: Linux 99754754ea79 6.6.74+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.6.74-1+rpt1 (2025-01-27) aarch64 GNU/Linux

[NL-TCH]

Thanks for the ping, do you know which OS is currently used for the container? Ubuntu 24. 04?

https://utcc.utoronto.ca/~cks/space/blog/linux/NftablesUbuntu2204Experience

Since in 22.04 the iptables command is actually using nftables, that means those machines silently started using nftables when we upgraded them to 22.04.

So changing iptables to nftables in theory would work!

[NL-TCH]

see https://wiki.debian.org/nftables (Should I replace an iptables firewall with a nftables one?)

so nftables is a long time replacement for iptables, due to iptables breaking it is now a nice time to switch to nftables

[billz]

@NL-TCH many thanks for the review, and yes—agreed. Related to this, our pi-gen fork detects the firewall backend and adds either nftables or iptables rules. On Debian bookworm it defaults to the former.