Date: Fri, 2 Jan 2026 19:32:30 -0600
From: "W. Michael Petullo" <mike@flyn.org>
To: ~alpine/devel@lists.alpinelinux.org
Subject: Preferred firewall
Message-ID: <aVhxrpww1wvEmBWB@imp.flyn.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

I maintain an application on Alpine, and I have become a little confused
about the distribution's preferred firewall stack. Until now, I have
used awall. Recently, I found that my approach had to change slightly,
because Alpine 3.23 does not by default provide the ip_tables module:

# modprobe ip_tables
modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.18.2-0-virt

Awall still seems to work due to the presence of x_tables, but this led
me to do some research that left me uncertain. Here are the questions I
am left with after reading several pieces of documentation:

It seems x_tables is old (e.g., https://lwn.net/Articles/155118/). Did
something change recently in Alpine to remove ip_tables (the kernel
module)?

Is it true that awall is tied to iptables (the utility)?

Does this mean that awall does not make use of nftables (the kernel
module)?

Which is preferred, awall or nftables?

Alpine's documentation still instructs to modprobe ip_tables
(https://wiki.alpinelinux.org/wiki/How-To_Alpine_Wall). Is this
now incorrect?

I am presently building Alpine installs using
https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/x86_64/alpine-virt-3.23.0-x86_64.iso.

-- 
Mike

:wq