Subject: Preferred firewall

From: "W. Michael Petullo" <[email-masked]>
Date: Fri, 2 Jan 2026 19:32:30 -0600

I maintain an application on Alpine, and I have become a little confused
about the distribution's preferred firewall stack. Until now, I have
used awall. Recently, I found that my approach had to change slightly,
because Alpine 3.23 does not by default provide the ip_tables module:

# modprobe ip_tables
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.2-0-virt

Awall still seems to work due to the presence of x_tables, but this led
me to do some research that left me uncertain. Here are the questions I
am left with after reading several pieces of documentation:

It seems x_tables is old (e.g., https://lwn.net/Articles/155118/). Did
something change recently in Alpine to remove ip_tables (the kernel
module)?

Is it true that awall is tied to iptables (the utility)?

Does this mean that awall does not make use of nftables (the kernel
module)?

Which is preferred, awall or nftables?

Alpine's documentation still instructs to modprobe ip_tables
(https://wiki.alpinelinux.org/wiki/How-To_Alpine_Wall). Is this
now incorrect?

I am presently building Alpine installs using
https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/x86_64/alpine-virt-3.23.0-x86_64.iso.

-- 
Mike

:wq

---

From: Kaarle Ritvanen <[email-masked]>
Date: Thu, 15 Jan 2026 15:32:26 +0200 (EET)

> something change recently in Alpine to remove ip_tables (the kernel 

Recent kernels do not enable the ip_tables module by default, and it is 
not enabled in all Alpine kernels (e.g. x86_64).

> Does this mean that awall does not make use of nftables (the kernel 

awall requires iptables but works with both backends (nftables and 
legacy). It does not interact with nftables directly.

> Which is preferred, awall or nftables?

You may use whichever you want. An increasing number of packages ship with 
nftables rule files.

> (https://wiki.alpinelinux.org/wiki/How-To_Alpine_Wall). Is this now 
> incorrect?

Yes, the page should be updated. Regardless of the iptables backend, there 
is no need to run 'modprobe'. You can use these commands instead for the 
initial setup:

awall translate         # update /etc/iptables
service iptables start  # load modules and rules for IPv4
service ip6tables start # load modules and rules for IPv6

There is also an easier method: 'awall activate' has special handling for 
the first run (when firewall is not yet enabled in the kernel). It 
performs the above steps and also updates the default runlevel and files 
in /etc/conf.d.

BR,
Kaarle

---

From: Dominique Martinet <[email-masked]>
Date: Sat, 3 Jan 2026 13:51:03 +0900

> because Alpine 3.23 does not by default provide the ip_tables module:

FWIW alpine 3.19 changed the default iptables package from
iptables-legacy to iptables-nft, so iptables commands (and thus as far
as I understand awall as well, although I didn't check) should not use
the ip_tables module, but nftables

If you still pull in iptables-legacy try using iptables-nft from the
iptables package

-- 
Dominique Martinet | Asmadeus

---

From: Sagar Acharya <[email-masked]>
Date: Sat, 03 Jan 2026 11:51:22 +0530

In my view, due to Maya (Illusion, better known as AI), it is impossible to classify bad packets from good ones. Text Maya is already solved and Alpine should add good packages for Maya, like torch7 and cutorch.

LLMs program so well that programming LLMs like Qwen, specialized for a certain language are very important.

We at Whitelist Tech, therefore say, whitelisting is the future, i.e. , whitelist certain IPs, using nftables. 

>https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/x86_64/alpine-virt-3.23.0-x86_64.iso.

===============
Thanking you
Sagar Acharya
https://whitelist.co.in