[
    {
        "role": "user",
        "content": "on%20linux%20I%20have%20been%20using%20shorewall%20under%20gentoo%20distribution%2C%20can%20I%20use%20shorewall%20nft%20under%20gentoo"
    },
    {
        "role": "assistant",
        "content": "Yes \u2014 you *can* use **shorewall-nft** on Gentoo, but it\u2019s not yet in the official Portage tree. You\u2019ll need to use an overlay or build from source. Here\u2019s a breakdown of what shorewall-nft is, what support currently exists in Gentoo, and how to get it running.\n\n---\n\n## What is shorewall-nft\n\n- **shorewall-nft** is a project that takes existing Shorewall configuration files (`/etc/shorewall`) and compiles them into **nftables** rules instead of using the old iptables-based backend. ([github.com](https://github.com/sol1/shorewall-nft?utm_source=openai))  \n- It aims for compatibility: much of what you already use in Shorewall should just work. The tool has a \"check\" function that tells you what parts of your configuration *won\u2019t* be supported before migrating. ([github.com](https://github.com/sol1/shorewall-nft?utm_source=openai))  \n- There are two variants:\n  1. **Full package**: includes the Python-based compiler and runtime.\n  2. **Lite version**: only the runtime, for targets where Python isn\u2019t available (e.g. small routers) and rulesets are compiled elsewhere. ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/lite.md?utm_source=openai))\n\n---\n\n## Gentoo support\n\n- Gentoo does **not** currently include an official `shorewall-nft` package in Portage. However, the shorewall-nft source provides an **ebuild** you can use. ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/distros.md?utm_source=openai))  \n- From the shorewall-nft documentation under \u201cGentoo\u201d:\n  > \"Full package (compiler and lite runtime) via an ebuild at packaging/gentoo/. It reuses the shared `install.sh`, so the layout matches the other distros. Runtime deps: `python 3.7+`, `net-firewall/nftables`, `sys-apps/iproute2`... There is **no ebuild in an official Gentoo repo yet**. Copy `packaging/gentoo/shorewall-nft-*.ebuild` into an overlay under `net-firewall/shorewall-nft/`, run `ebuild <file> manifest`, then `emerge` it. \" ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/distros.md?utm_source=openai))  \n\n---\n\n## What you need to use it on Gentoo\n\nHere are prerequisites and steps:\n\n1. **Dependencies**:  \n   - Python 3.7 or newer  \n   - `nftables` package  \n   - `iproute2` (the `ip` tool) ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/distros.md?utm_source=openai))  \n   - Your kernel must support nftables and the features you need\n\n2. **Get the ebuild**:  \n   Since it isn\u2019t in official repos, use an overlay. You copy the ebuild from the shorewall-nft GitHub under `packaging/gentoo/shorewall-nft-*.ebuild`. ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/distros.md?utm_source=openai))\n\n3. **Build & install**:  \n   - After putting the ebuild in your overlay under `net-firewall/shorewall-nft/`, run `ebuild <filename> manifest`  \n   - Then `emerge shorewall-nft` (or however the ebuild names the package)  \n   - If needed, unmerge the old `net-firewall/shorewall` package first so there are no conflicts ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/distros.md?utm_source=openai))\n\n4. **Migration path**:  \n   - First run `shorewall-nft check /etc/shorewall` to see if your current configs will translate without errors. The tool will flag anything unsupported. ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/migration.md?utm_source=openai))  \n   - If everything is good, you can use `shorewall migrate` to switch the ipv4 backend to nftables (similarly `shorewall6 migrate` for IPv6). The process handles service enabling, ruleset app loading, and cleaning up old iptables rules. ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/migration.md?utm_source=openai))  \n   - Until migration, Shorewall continues using iptables (or iptables-nft compatibility layer). ([github.com](https://github.com/sol1/shorewall-nft?utm_source=openai))\n\n---\n\n## Caveats & gotchas\n\n- Some parts of Shorewall\u2019s old feature set may not be supported or behave slightly differently under nftables. The `check` step helps identify those. ([github.com](https://github.com/sol1/shorewall-nft?utm_source=openai))  \n- The `lite` version lacks some dynamic capabilities: e.g. dynamic multi-ISP failover and active geoip set updates must be done via the full version. ([github.com](https://github.com/sol1/shorewall-nft/blob/main/docs/lite.md?utm_source=openai))  \n- Shorewall upstream (the original iptables-based Shorewall) appears to be abandoned or dormant. There are no new releases planned, and the move is toward nftables-based tools. ([sourceforge.net](https://sourceforge.net/p/shorewall/mailman/shorewall-devel/thread/20260629210028.55c77b55%40tuomo.foobar.fi/?utm_source=openai))\n\n---\n\n## Verdict\n\nIf you're using Gentoo and want to migrate your firewall ruleset from iptables-based Shorewall to nftables, **shorewall-nft** is a solid path forward.\n\n- You\u2019ll just need to set up an overlay with the provided ebuild.\n- Make sure you test using `check` and do the migration carefully.\n- For new installs or simpler setups, using nftables directly or other tools might be easier.\n\n---\n\nIf you want, I can walk you through creating the overlay and ebuild step-by-step for Gentoo, or explore alternatives. Do you want to do that?"
    }
]