firewall

package

v0.12.0 Latest Latest Go to latest Published: Jul 28, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/OpceanAI/Doki

Links

Open Source Insights

Documentation ¶

Overview ¶

Package firewall provides a backend abstraction for port-mapping and NAT rules that auto-detects nftables vs iptables at runtime.

On Linux in 2026, modern distributions (Fedora 40+, Ubuntu 24.04+, RHEL 10, openSUSE Leap 16+) ship nftables only and no longer provide iptables-legacy. Older systems (Debian 11, Ubuntu 22.04) provide iptables-legacy. This shim probes both and picks the first one that is functional, with a hard preference for nftables when available.

iptables backend implementation for the firewall Manager.

This is the legacy path used by older distros (Debian 11, Ubuntu 22.04 with iptables-legacy) and by hosts where nft is not available.

nftables backend implementation for the firewall Manager.

Index ¶

Variables
type Backend
- func Detect(ctx context.Context) Backend
type Manager
- func Open(ctx context.Context, opts Options) (Manager, error)
type Options
type Rule

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrNoBackend = errors.New("no firewall backend available (nft or iptables)")

ErrNoBackend is returned when neither nft nor iptables is available.

Functions ¶

This section is empty.

Types ¶

type Backend ¶

type Backend string

Backend identifies which underlying firewall tool is in use.

const (
	BackendNFTables    Backend = "nftables"
	BackendIPTables    Backend = "iptables"
	BackendUnavailable Backend = "unavailable"
)

func Detect ¶

func Detect(ctx context.Context) Backend

Detect returns the preferred backend for this host, probing nftables first, then iptables. It is safe to call before Open.

type Manager ¶

type Manager interface {
	Backend() Backend
	Apply(ctx context.Context, rule Rule) error
	Remove(ctx context.Context, rule Rule) error
	List(ctx context.Context) ([]Rule, error)
	Reload(ctx context.Context) error
	Close() error
}

Manager is the firewall backend abstraction. Implementations must be safe for concurrent use.

func Open ¶

func Open(ctx context.Context, opts Options) (Manager, error)

Open selects the appropriate backend and returns a ready Manager. The decision is made once at Open time; the manager caches it.

The chain name and table name are configurable so multiple Doki instances on the same host can coexist without stomping on each other's rules.

type Options ¶

type Options struct {
	// Preferred forces a specific backend. Empty = auto-detect.
	Preferred Backend
	// TableName is the nftables table or iptables chain prefix.
	// Default: "doki".
	TableName string
	// Family is "inet" (nftables) or "ipv4"/"ipv6" (iptables).
	// Default: "inet" for nftables, "ipv4" for iptables.
	Family string
	// IPv6 enables the ipv6 backend as well. Default: true.
	IPv6 bool
}

Options configures the firewall manager.

type Rule ¶

type Rule struct {
	HostIP        string
	HostPort      uint16
	ContainerIP   string
	ContainerPort uint16
	Protocol      string // "tcp" or "udp"
	ContainerID   string // for tracking / removal
}

Rule represents a single port-forward rule: publish hostPort to containerIP:containerPort with a protocol.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL