Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Added

• Editor, Compiler (iptables, nftables): a rule with the Custom action carries one statement per packet filter, the way a Custom Service carries one code per platform. A firewall switched from iptables to nftables keeps both and each compiler reads its own; it used to keep the one statement it had, which the other packet filter refuses (#161).
• Compiler (nftables): a rule whose service matches the ToS byte compiles instead of being left out.
• Compiler (nftables): the generated script offers reload_address_table, add_to_address_table, remove_from_address_table and test_address_table, with the same arguments and the same answers as the iptables script, so a block list can be kept up to date without recompiling the firewall.
• Compiler (nftables): the generated script says which nftables release it was compiled for, the way the iptables script has always said its own.

Fixed

• Data file: a rule of a hand-written .fwf file that names no position is numbered by its place in the file. Every rule of such a rule set used to be rule 0, so the generated script named the wrong rule in every message and the shadowing check reported a rule as shadowing itself.
• Compiler (iptables): the "stop" command of the generated script touches only the address families the firewall has rules for. On a firewall with no IPv6 rules it used to set the IPv6 policies to ACCEPT - opening a family this script never closed - and to exit non-zero on a host without ip6tables, so an init system read a successful stop as a failure.
• Compiler (iptables): the four commands that maintain a run-time address table answer with an exit code, test_address_table finds an address that one of the table's networks covers, and an address listed twice or added twice is not an error. test_address_table used to say the same thing for an address in the table and one that is not, a reload from a file that is not there reported success, and an address ipset refused was skipped without a word.
• Compiler (iptables): a firewall pinned below ip6tables 1.2.8 leaves out the IPv6 neighbour discovery rules, whose hop limit match that release has not got. The activation used to stop there with every built-in policy already set to DROP, so the firewall came up with no rules at all.
• Compiler (iptables): a dual-stack firewall looks for ip6tables before it installs a rule. A wrong path or a machine without the tool used to be found only after the IPv4 rules were in place, leaving IPv4 filtered and IPv6 open with no rules at all.
• Compiler (iptables): adding, removing or testing an IPv6 address of a run-time address table from the command line works. The three commands used to hand every address to the set of the other family, which ipset refuses, so the address was neither added, removed nor tested while the data file said otherwise.
• Compiler (iptables): an address table with more than 65536 addresses fills the set the rules match against. The set used to take the first 65536 and refuse the rest, so a Deny rule built on a large block list blocked only part of it while the activation reported success.
• Compiler (iptables): the generated script says it was compiled for iptables even when the firewall object names the other platform; the header used to name a packet filter the script does not use.
• Compiler (iptables): a NAT rule that translates to a DNS name resolved on the firewall is reported and left out instead of stopping the activation; iptables never read a name there, so the script used to abort at that command with every policy already set to DROP.
• Compiler (iptables, nftables): a firewall that routes both address families out of one interface installs a default route in each; the IPv6 one used to be dropped as a duplicate of the IPv4 one.
• Compiler (iptables, nftables): a firewall that installs a default route in one address family keeps the one the machine came up with in the other; the IPv4 default route used to be deleted by a script that installs only an IPv6 one, and nothing put it back.
• Compiler (iptables, nftables): a routing rule whose gateway is an IPv6 link-local address installs its route instead of being reported and left out; that is the address a router advertisement carries, so it is the ordinary form of an IPv6 route.
• Compiler (iptables, nftables): a firewall that fails to activate gets its routing table back even when it holds a route with several next hops; such a route used to be saved in pieces and was gone after the rollback.
• Compiler (iptables, nftables): a firewall that installs an IPv6 route can be activated more than once; every activation after the first used to stop at that route, put the previous routing table back and report failure.
• Compiler (iptables, nftables): a rule whose service names a ToS value no packet can match is reported and left out. iptables used to install it without a word, where it sat in the ruleset matching nothing.
• Compiler (iptables, nftables): a NAT rule whose Original Service matches the ToS byte or a DiffServ code point is compiled instead of being left out. Both packet filters match that field in a NAT chain like anywhere else.
• Compiler (iptables, nftables): a rule with the Branch action jumps into the rule set it points at even after that rule set has been renamed. The jump used to go to the old name: iptables created an empty chain of that name and jumped into it, so the branch did nothing in a script that activated cleanly, and nftables left the rule out.
• Compiler (iptables, nftables): a NAT rule the compiler cannot classify is named in the message that reports it, instead of leaving the administrator with "Unsupported NAT rule" and no rule number.
• Compiler (iptables, nftables): a message about an interface without a usable address names the interface by its place in the object tree instead of by an internal id, so it can be found in the editor and reads the same on every compile.
• Compiler (iptables, nftables): whether an Address Table or a DNS Name is resolved on the firewall or at compile time is read the way Firewall Builder reads it, so a data file that spells the flag out as text no longer turns a compile-time object into a run-time one.
• Editor: the tooltip of an Address Table and of a DNS Name names the file or the DNS record it resolves from and says whether it is resolved on the firewall; it used to say "Compile-time" for every one of them and never name the source.
• Editor: the firewall panel offers nftables 0.9.1 as a release to compile for. Its oldest entry used to cover 0.9.0 and 0.9.1 together, although the two differ in what they can parse.
• Compiler (nftables): a NAT rule of a cluster that translates to, or matches on, a cluster interface without a fixed address uses the interface the member firewall actually has. The generated script used to read the address of the cluster's own interface name, which exists on no machine, so the source translation left the packets with their original address and the destination translation never matched.
• Compiler (nftables): a reload of an address table that nft refuses leaves the addresses that were in the set. Emptying the set and filling it again are one transaction, so a failed reload no longer leaves a block list that blocks nothing.
• Compiler (nftables): a NAT rule whose Original Service element is negated and cannot be excluded by one match compiles instead of being left out, in the same chain the iptables compiler builds for it.
• Compiler (nftables): a rule whose service element is negated and names a Custom Service compiles instead of being left out, in the same chain the iptables compiler builds for it. A Deny rule written as "anything but this" used to be dropped, so it blocked nothing.
• Compiler (nftables): a rule whose service element is negated and names an IP service that matches a DiffServ code point or a fragment excludes it together with the rest of the element, in the temporary chain the iptables compiler builds for the same rule. Such a service says nothing about the protocol, so the rule it used to get for itself matched packets the element excludes.
• Compiler (nftables): a rule whose service element is negated and names an IP service that matches its protocol and a second condition at once compiles instead of being reported, and no longer leaves the rest of the element standing as a rule of its own.
• Compiler (nftables): a rule whose service element is negated and names a whole protocol - "All TCP", an ICMP service with no type, or an IP service naming nothing but its protocol number - excludes it together with the rest of the element. Such a service used to get a rule of its own that matched every packet of every other protocol, so a Deny rule written for "anything but IPsec" dropped everything and an Accept rule let everything through.
• Compiler (iptables, nftables): the generated script passes shellcheck again, on both packet filters. The nftables script had never been checked at all, and a routing firewall's script could not be read by the tool.
• Compiler (nftables): a NAT rule that translates for everything except a list of addresses no longer puts those addresses on an interface of the firewall. The generated script used to configure them, so the firewall answered for addresses the rule was written to leave alone.
• Compiler (nftables): a firewall pinned to nftables 0.9.0 gets a ruleset that release can read. Every chain named its priority in words, which 0.9.0 cannot parse, so the whole ruleset was refused and the firewall kept the rules it had.
• Compiler (nftables): a rule that limits concurrent connections per source is reported and left out on a firewall pinned to nftables 0.9.0, which cannot parse the set it counts in. Such a rule used to cost the whole ruleset, so the firewall kept the rules it had.
• Compiler (nftables): an address table whose data file carries a note behind an address fills the set the rules match against. One such line used to leave the whole table out, so a Deny rule built on that block list stopped nothing.
• Compiler (nftables): an address table with more than about eleven thousand addresses fills the set the rules match against. Such a table used to leave the set empty, so a Deny rule built on a large block list blocked nothing.

v3.0.0 - 2026-09-04

Highlights: Clusters are supported: compiling a cluster compiles each of its members, with the cluster's interfaces, addresses, rule sets and routes, and each member permits the failover protocol and the state sync link it needs, so a default-drop cluster no longer has both members thinking they are master. The nftables compiler catches up with the iptables one on what it was still missing: negated elements, Custom Services, custom actions, translating to a DHCP or PPP address, and "Use SNAT instead of MASQUERADE". A large group of fixes is about rules that quietly matched something other than what they say, most of them around negation, and about activations that stopped half-way with the firewall already at DROP while reporting success. Configurations that used to be compiled from unusable data are now refused. Recompile and review your rulesets after updating, and read the breaking changes first.

Breaking Changes

• A bridge port named like a VLAN interface is refused unless the firewall also has an interface of its own under that name. Add it; nothing else creates the device.
• A firewall with an interface that has no address is refused instead of compiled. Give the interface an address, or take it out of the firewall object.
• A rule whose Custom action holds a command written for the other packet filter is reported and left out. Rewrite the statement after switching a firewall between iptables and nftables.
• The release a firewall names belongs to the platform it names, so a firewall switched between the two platforms may compile differently. Check the release in the firewall panel.

Added

• Compiler (iptables, nftables): a cluster member permits the failover protocol and the state sync link it needs, and leaves the shared address to the failover daemon (#84).
• Compiler (iptables, nftables): a rule can name an "Attached Networks" object, whose subnets are worked out on every compile (#85).
• Compiler (iptables, nftables): compiling a cluster compiles each of its members, with the cluster's interfaces, addresses, rule sets and routes (#84).
• Compiler (nftables): a Custom Service that matches the connection state, TCP flags, the socket owner or the IPv6 routing header compiles instead of being left out.
• Compiler (nftables): a logged rule keeps its own connection or rate limit beside the firewall's log rate.
• Compiler (nftables): a NAT rule translates to the address of a DHCP or PPP interface, and "Use SNAT instead of MASQUERADE" names that address instead of masquerading.
• Compiler (nftables): a negated time restriction that names both hours and weekdays compiles.
• Compiler (nftables): a rule the pinned nftables release cannot parse is reported and left out instead of costing the whole ruleset.
• Compiler (nftables): a rule with a Custom action writes its statement into the ruleset.
• Editor: a cluster has an editor of its own, and a failover or state sync group can be created where it belongs, with its address, port and mode (#84, #78).
• Editor: an "Attached Networks" object can be created on an interface and has an editor of its own (#85).
• Editor: the Branch action can be set on a rule again, and the rule set it jumps into is chosen by dragging it out of the object tree (#90).
• Editor: the firewall panel offers the iptables and nftables releases a firewall can be compiled for.
• Standard library: the "ESTABLISHED" custom services carry nftables code.

Fixed

• Compiler (iptables): "Clamp MSS to MTU" reaches the generated script again on a firewall pinned to an older iptables release.
• Compiler (iptables): a firewall that keeps other tools' rules honours the setting when it activates through iptables-restore, and no longer gains a copy of its clamping and connection-mark rules on every activation (#42).
• Compiler (iptables): a firewall using ipsets fills them before it installs the rules that name them, so the first activation after a reboot no longer loses every rule about an address table while reporting success.
• Compiler (iptables): a masquerading rule with a negated element no longer produces a command iptables refuses.
• Compiler (iptables): a rate limit gets a table of its own per rule set, and a name too long for iptables is cut and reported instead of shared by accident.
• Compiler (iptables): a rule that excludes a single host is written with one "!" instead of a temporary chain, so a NAT rule translating to that host configures its address again.
• Compiler (iptables): a rule with two negated elements matches what it says and is compiled into the rules Firewall Builder writes for it; an "outside business hours" rule used to match around the clock.
• Compiler (iptables): a time-based rule on a firewall pinned to an iptables older than 1.4.11 says that it matches in UTC.
• Compiler (iptables): an IPv6-capable firewall hardens its IPv6 stack even when all its IPv6 rules were dropped.
• Compiler (iptables, nftables): "clear IP addresses of unknown interfaces" recognises an interface named with a wildcard and never takes the loopback down.
• Compiler (iptables, nftables): "reload" no longer stops the firewall first, which left the machine unprotected until the second command finished.
• Compiler (iptables, nftables): a branch into a rule set of another firewall or cluster, and a NAT rule set branching into another one, compile that rule set into the script with chains of their own (#156).
• Compiler (iptables, nftables): a branch rule that leads back to where it started is reported as a loop, in FirewallFabrik's own file format as well.
• Compiler (iptables, nftables): a bridge configured below another interface is reported instead of being silently left unbuilt.
• Compiler (iptables, nftables): a cluster group keeps its rules when its failover or state sync address is IPv6, instead of losing them without a word, and a port that is not a number is reported.
• Compiler (iptables, nftables): a cluster whose interface gets its address by DHCP translates to it again, instead of losing every NAT rule that names it.
• Compiler (iptables, nftables): a firewall that configures its own bridges creates them before their addresses, attaches every port including one named with a wildcard, and leaves the bridges of Docker, podman and libvirt alone.
• Compiler (iptables, nftables): a firewall that names a VLAN or bonding interface is warned that the script does not create it, instead of stopping the activation before the first rule with no word about why (#95).
• Compiler (iptables, nftables): a firewall whose conntrack limits are left unset no longer sets them to zero on activation, which made the kernel refuse every new connection.
• Compiler (iptables, nftables): a generated script reports the activation as failed when any of its commands was refused, and answers "status" with "Firewall is active" once its rules are installed.
• Compiler (iptables, nftables): a NAT rule that translates to an address none of the firewall's interfaces is on says so, instead of failing silently because nobody answers ARP for it.
• Compiler (iptables, nftables): a routing rule that fails puts the previous routing table back and stops the activation unless it is marked "non-critical"; a route two rules install the same way is installed once, and an unreachable gateway is reported.
• Compiler (iptables, nftables): a rule assigned to several interfaces is compiled for each of them, so a dual-stack rule no longer disappears from one address family.
• Compiler (iptables, nftables): a rule matching a MAC address or the socket owner is judged by the hook its chain hangs off, so the kernel no longer refuses a command in the middle of an activation.
• Compiler (iptables, nftables): a rule naming a host that has only an IPv4 address, or one address table per address family, compiles in a dual-stack rule set instead of stopping the firewall from compiling.
• Compiler (iptables, nftables): a rule naming an interface covers every address it carries and the VLANs below it, instead of the first address alone.
• Compiler (iptables, nftables): a rule that names a packet mark, a connection owner or a custom service beside an ordinary service installs the two in the order Firewall Builder installs them.
• Compiler (iptables, nftables): a rule whose group, interface group or address table turns out to be empty is reported instead of applying to every address or every interface the firewall has.
• Compiler (iptables, nftables): a rule written for "any interface except these" leaves out a dedicated failover link and is no longer reported as shadowing an unrelated rule.
• Compiler (iptables, nftables): an address object whose address and netmask are both zero matches every address, and is reported as being equivalent to "any".
• Compiler (iptables, nftables): an ICMP service, an IP protocol number, a time object or a routing metric that is empty or impossible is reported instead of breaking the compile or matching everything.
• Compiler (iptables, nftables): an interface whose name is longer than an interface name can be is reported instead of stopping every activation before the first rule.
• Compiler (iptables, nftables): the address and netmask of a VLAN interface or a bridge port is checked the way the firewall's own interfaces are; a netmask of /0 one level down used to make every rule naming it match everything.
• Compiler (iptables, nftables): the half of a rule that sets a traffic class stays in the chain the qdisc reads, instead of one where the kernel refuses it.
• Compiler (nftables): "Log all rules" also logs the rules that tag or classify.
• Compiler (nftables): a negated service the compiler cannot say in one rule gets a chain of its own, the way iptables writes it, or is reported - no part of it is left behind matching what it excludes.
• Compiler (nftables): a rule naming a dynamic interface of the firewall's own cluster is compiled instead of being left out.
• Compiler (nftables): a rule naming a TCP service that inspects the TCP flags beside the matching UDP service keeps the flag inspection, instead of applying to every packet on that port.
• Compiler (nftables): a rule naming an unnumbered interface or a bridge port is left out instead of matching every address there is.
• Compiler (nftables): a rule whose source, destination or service is negated matches what it says; several of them matched every packet, so a Deny rule blocked all traffic and an Accept rule let all of it through.
• Compiler (nftables): a tagging or classifying rule is left out on a firewall configured not to forward packets, the way the iptables compiler leaves it out.
• Compiler (nftables): a time-based rule on a firewall that uses the kernel timezone writes dates nftables accepts, instead of ones that make it refuse the whole ruleset.
• Compiler (nftables): an accounting rule that logs counts every packet once.
• Compiler (nftables): the generated script finds nft and ip wherever the distribution puts them, and checks that its tools are there before it touches the firewall.
• Compiler (nftables): the old rules are removed after the new ones are in place, so an activation no longer leaves the machine without a firewall in between.
• Editor: a failover group is shown below its cluster interface and a state sync group below its cluster, and each is checked against the cluster it belongs to (#78).
• Editor: a rule branching into a rule set of another firewall keeps pointing at it after the file is saved and reopened.
• Editor: changing or deleting an object marks every firewall whose rules name it as needing a recompile (#159).
• Editor: opening the action parameters of a NAT rule no longer risks clearing the rule's other settings, and names the NAT rule set a Branch action asks for.
• Editor: renaming an interface or its firewall also renames the failover group and the "Attached Networks" object below it.
• Editor: the conntrack limits and the two TCP timeouts of the Linux host settings can be left at the kernel default again.
• Editor: the iptables settings offer "use kernel timezone" and the ipset match only on a firewall pinned to a release that has them.

v2.0.0 - 2026-08-24

Highlights: Both compilers went through a full correctness pass against Firewall Builder. Rules that used to compile into something other than what the GUI shows are now either compiled correctly or reported at compile time, instead of silently matching every address, every service or nothing at all. Recompile and review your rulesets after updating, and read the breaking changes first.

Breaking Changes

• A rule set other than the firewall's top rule set is compiled into a chain of its own and only runs when a Branch rule jumps to it. Merge it into the top rule set if it is meant to apply everywhere.
• A rule set that sets neither "IPv4" nor "IPv6" is compiled for IPv4 only. Set it to "IPv4 and IPv6" to keep its IPv6 rules.

Added

• Compiler (iptables, nftables): the "Limit matching rate" options that count per source, destination or port (#121).
• Compiler (iptables, nftables): the "Limit number of simultaneous connections" rule option (#120).

Changed

• FirewallFabrik installs on Python 3.11 and newer, so current distributions no longer need a custom Python build.
• The nftables firewall settings no longer show three options that only ever applied to iptables.

Removed

• The --xt option of fwf-ipt.

Fixed

• Compiler (iptables): "Clear all rules" clears them on current distributions.
• Compiler (iptables): a firewall activating through iptables-restore loads its ruleset and keeps its rule comments and log prefixes.
• Compiler (iptables): a firewall pinned to an older iptables release gets rules that release can load; a firewall pinning nothing is compiled for current iptables.
• Compiler (iptables): a firewall that keeps other tools' rules manages its NAT and packet-marking rules the same way as its filter rules.
• Compiler (iptables): a name carrying shell syntax, whether of a rule set, branch, interface, address table or log prefix, is refused at compile time instead of running as a command on the firewall.
• Compiler (iptables): the generated script waits at most five seconds for the iptables lock instead of blocking an unattended rollout forever.
• Compiler (iptables, nftables): "Add virtual addresses for NAT" and "Add rules to permit IPv6 Neighbor Discovery" generate their rules (#143).
• Compiler (iptables, nftables): "Always permit SSH access from the management workstation" installs that rule in the ruleset, not only in block and stop.
• Compiler (iptables, nftables): "MAC address matching" on a host takes effect, and a MAC match is reported or dropped where the packet no longer carries one.
• Compiler (iptables, nftables): a Branch rule jumps into the rule set it names, including packet-marking rule sets, NAT branches and branches imported from a .fwb file.
• Compiler (iptables, nftables): a compile the compiler refuses writes no script, says so and exits non-zero.
• Compiler (iptables, nftables): a dual-stack firewall keeps each single-stack rule in the address family it names.
• Compiler (iptables, nftables): a Reject rule sends the ICMP message its reject type names, and falls back to the default type where a TCP reset cannot apply.
• Compiler (iptables, nftables): a rule about the firewall's own addresses, its networks, broadcast and multicast traffic or its bridged paths lands in the chains that traffic really takes.
• Compiler (iptables, nftables): a rule limited to a calendar window keeps that window.
• Compiler (iptables, nftables): a rule naming a host or interface whose address comes from DHCP or PPP matches the address the machine has.
• Compiler (iptables, nftables): a rule the compiler cannot express is reported and left out instead of being installed without that condition.
• Compiler (iptables, nftables): a rule whose source, destination or service resolves to nothing is left out instead of matching every address or every protocol.
• Compiler (iptables, nftables): a rule written for "any interface except these" no longer produces rules on loopback, unprotected, bridge-port and cluster interfaces.
• Compiler (iptables, nftables): an address table whose file is empty or unreadable no longer matches every address, and the file is checked before the running ruleset is replaced.
• Compiler (iptables, nftables): an IPv6 rule written for a whole network no longer matches a single address, and a value that is no netmask is reported at compile time (#154).
• Compiler (iptables, nftables): log prefixes, log levels and the NFLOG "Copy range" and "Queue threshold" settings reach the generated ruleset, and an over-long prefix is reported instead of cut.
• Compiler (iptables, nftables): NAT rules translate what the editor shows, among them port-only translations, one-to-one network maps, load balancing over several backends, MASQUERADE and exclusions.
• Compiler (iptables, nftables): rate limits and connection limits are enforced at the rate the editor names, and values the packet filter cannot take are reported at compile time.
• Compiler (iptables, nftables): routing rules install the routes they name; several rules for one destination become one route with several next hops, and an unreachable gateway is reported.
• Compiler (iptables, nftables): rules that tag packets, assign a traffic class or match a tag do so, and a Tag Service survives saving and reopening the file (#122).
• Compiler (iptables, nftables): the check for rules hidden by an earlier rule reports each finding once and names its rule set (#136).
• Compiler (iptables, nftables): the kernel-hardening, connection-tracking and packet-forwarding settings take effect, and a setting the file does not carry takes the default the dialog shows.
• Compiler (nftables): a negated address, service, interface or time restriction matches the opposite of what it names.
• Compiler (nftables): a rule matching a DNS name, a dynamic interface or an address table read on the firewall is filled in at activation time instead of being left out.
• Compiler (nftables): a rule set or object whose name collides with an nftables keyword or a chain name is renamed and the rename reported.
• Compiler (nftables): a ruleset nftables refuses leaves the running rules in place instead of the host with none.
• Compiler (nftables): generated rules carry a counter, so nft list ruleset shows per-rule hit counts.
• Compiler (nftables): the generated activation script reports success when the ruleset loaded.
• Editor: a netmask or an address the compilers cannot read is refused where it is typed.
• GUI: deleting an object disables the rules whose last source, destination or service it was.
• GUI: File > Import Library works.
• GUI: the firewall settings offer the same "Default action on Reject" choices as the per-rule action editor.
• Import: an object imported from a Firewall Builder file keeps its tags.
• Installing firewallfabrik[gui] resolves its Qt dependency again.

v1.9.0 - 2026-07-12

Added

• CLI: fwf-upgrade converts a Firewall Builder .fwb file and brings an older .fwf file to the current format without opening the GUI (#132).

v1.8.1 - 2026-07-01

Fixed

• GUI: FirewallFabrik no longer crashes when the object tree is rebuilt while a search is open.

v1.8.0 - 2026-06-29

Added

• Compiler (iptables, nftables): the "Accept ICMP redirects" and "Accept source-routed packets" hardening settings also apply to IPv6.
• Compiler (nftables): the kernel-hardening and conntrack tuning settings of the firewall's Host OS settings are applied by the generated script.

Deprecated

• Host OS setting "TCP fack": the Linux kernel dropped FACK loss detection, so the setting has no effect on any supported release.

Fixed

• Compiler (iptables): the conntrack tuning settings reach the kernel.
• Compiler (nftables): switching a firewall from iptables to nftables removes the leftover iptables rules on activation, which could shadow the new ones.
• Compiler (nftables): the backup SSH access rule of the "block" action is generated, which could lock an administrator out.
• GUI: the "Update Standard Library" preview lists the affected firewalls and rules.

v1.7.0 - 2026-06-18

Added

• GUI: "Collapse", "Collapse All", "Expand" and "Expand All" in the object tree context menu.

Fixed

• GUI: editing a standalone IPv4 or IPv6 address no longer shows a Netmask field. On an interface address, where it matters, it still appears.
• GUI: selecting a predefined Any object shows what Any matches in a rule instead of an editable form with meaningless values.

v1.6.0 - 2026-05-07

Added

• Compiler (iptables): the "Use kernel timezone" setting is honoured on time-restricted rules.
• Compiler (iptables, nftables): the "Log IP options", "Log TCP options" and "Log TCP sequence numbers" settings are honoured on logging rules.

Changed

• GUI: File > Open Recent tells entries apart by their differing path segments.

Fixed

• GUI: the iptables and nftables firewall settings no longer mark options as unsupported that the compiler does honour, among them "Drop new TCP sessions without SYN", "Log all rules" and "Clamp MSS to MTU".
• GUI: the nftables firewall settings grey out the options the nftables compiler does not implement. They accepted clicks and had no effect.

v1.5.1 - 2026-05-07

Fixed

• GUI: opening the Platform Settings dialog of an nftables firewall no longer crashes.

v1.5.0 - 2026-04-29

Added

• GUI: renaming a firewall, host or interface that has child objects offers to rename the children along the standard naming scheme.
• GUI: the Install options dialog takes a password or passphrase, so a passphrase-protected SSH key or password authentication works from the dialog (#72).

Changed

• Compiler (iptables, nftables): an address range that covers an exact CIDR block is compiled to the short CIDR form.
• GUI: Dynamic Groups combine their criteria with AND instead of OR, which closes a class of overly permissive rules. A per-group selector switches back to OR (#82).
• GUI: the interface context menu no longer offers "New Attached Networks" or "New Failover Group". Both return with the cluster support (#78, #84, #85).
• GUI: the Policy and NAT action menus no longer offer "Branch". It returns with full branch support (#83, #90).

Fixed

• CLI: fwf-ipt --all and fwf-nft --all skip firewalls flagged inactive (#89).
• Compiler (iptables): a firewall used as source or destination expands to one rule per own address, so an anti-spoofing rule covers the other own addresses too.
• Compiler (iptables): recompiling an unchanged policy produces a byte-identical script, so CI pipelines no longer see phantom changes.
• Compiler (iptables): the "TCP fin timeout" and "TCP keepalive interval" settings left at their default are no longer pushed into the kernel as 0.
• Compiler (iptables): with "Use iptables-restore" the rules are written in the form iptables-restore accepts, which it used to reject (#77).
• Compiler (iptables, nftables): a custom service that has code for the target platform is recognised instead of aborting the compile (#71).
• Compiler (iptables, nftables): a firewall interface with address 0.0.0.0 or :: or with netmask /0 aborts with a clear error instead of producing dead rules.
• Compiler (iptables, nftables): Custom, Tag and User Services reach the generated rules. Their code was dropped, so an established/related rule became a bare accept (#72).
• Compiler (iptables, nftables): IPv6 reject rules use the IPv6 reject types, so the IPv6 script loads on the firewall.
• Compiler (iptables, nftables): no more spurious shadowing warnings for rules whose source or destination is "any" and for TCP services that inspect TCP flags (#73).
• Compiler (iptables, nftables): rules that use an address range land in the right chains and are matched instead of being dropped, which produced permissive masquerading and missing rules.
• Compiler (nftables): a Reject rule with "TCP RST" on non-TCP services falls back to the configured reject action, and a rule mixing both is split.
• Compiler (nftables): an MSS clamping rule is generated when "Clamp MSS to path MTU" is set, matching iptables.
• Generated script: "stop" resets the built-in chain policies to ACCEPT after flushing. They stayed at DROP, so the firewall kept blocking all traffic after a stop.
• Generated script: every action checks for the tool it needs and aborts with a clear message.
• GUI: File > Reload works for native .fwf files and imported .fwb files alike.
• GUI: the Install rules destination path is no longer built by concatenating the local output path with the remote directory, which aborted the copy (#72).

Removed

• The legacy "Use ULOG" firewall option. The Linux kernel removed the ULOG target years ago; a .fwb file that still carries it is migrated to LOG on import.
• The nftables firewall settings no longer expose iptables-only options the nftables compiler cannot act on.

Security

• The Firewall Builder .fwb importer is hardened against malformed and malicious input files. Regular files import unchanged.

v1.4.6 - 2026-04-09

Fixed

• GUI: all popup dialogs have a visible border on GNOME/Wayland.
• GUI: the Options column of the Policy, NAT and Routing editors shows the "Options" icon when non-default rule options are set.

v1.4.5 - 2026-04-09

Changed

• GUI: the Compile dialog groups each firewall under its own heading and reports "Compiled with Warnings" or "Compile Error" in the progress column.

Fixed

• Compiler (iptables): the generated scripts are POSIX sh compliant and pass shellcheck without warnings (#36).
• Compiler (iptables, nftables): a compiler warning no longer makes the compilation report as failed; the exit code stays 0.
• GUI: the Delete key works on selected elements in the policy editor.
• GUI: the scrollbars in the object tree and policy editor are visible on every desktop theme.

v1.4.4 - 2026-04-08

Fixed

• GUI: no more sporadic crash when rebuilding the object tree after compilation or when closing and creating files (#57).
• GUI: the Custom Service editor remembers the selected platform instead of resetting to nftables (#61).

v1.4.2 - 2026-04-08

Fixed

• GUI: the object tree attribute column is wide enough on first use when "Show object attributes in the tree" is enabled (#60).

v1.4.1 - 2026-04-08

Fixed

• GUI: pyside6-rcc is found when FirewallFabrik is installed with uv tool install (#58).
• GUI: FirewallFabrik starts on Wayland-only systems such as GNOME without X11 (#58).
• GUI: no more sporadic crash when opening a rule editor while another editor has unsaved changes (#57).

v1.4.0 - 2026-03-29

Added

• Compiler (iptables, nftables): "Flush entire ruleset". With the option off, FirewallFabrik only manages its own tables and chains and leaves rules created by Docker, CrowdSec or fail2ban untouched.

Changed

• Defaults: output file name fwf.sh instead of the firewall object name, script directory /etc instead of /etc/fw, table and chain prefix fwf instead of linuxfabrik.

Fixed

• Compiler (iptables, nftables): compiler messages name the rule position instead of the colour label.
• Compiler (iptables, nftables): IPv6 rules are generated from the rule set's address family setting instead of requiring IPv6 addresses on the firewall's interfaces (#42).
• Generated script: "stop" keeps the chain policies at DROP, so the host is not left wide open after a stop.
• Generated script: the script aborts on failure instead of continuing with an incomplete ruleset.
• Generated script: with "Flush entire ruleset" off, "status" detects whether the firewall is active even when other tools create additional chains.
• Generated script: with "Flush entire ruleset" off, "stop" removes all FirewallFabrik chains and jump rules, including sub-chains and the iptables-nft backend, and restores the chain policies to ACCEPT so other tools keep working (#42).
• GUI: FirewallFabrik no longer crashes when Ctrl+C is pressed in the terminal.
• GUI: IPv6 address and network dialogs accept prefix lengths 0 to 128 (#50).

v1.3.0 - 2026-03-17

Added

• Compiler (iptables, nftables): bridge interfaces are configured through iproute2, and bridge ports are detected from the parent interface type.
• GUI: Alt+Return opens the editor for the selected object.
• GUI: Advanced Interface Settings dialog for device type (ethernet, VLAN, bridge, bonding), VLAN ID, STP and bonding parameters.
• GUI: Appearance tab in Preferences for fonts, direction and action text, comment clipping and toolbar labels.
• GUI: Installer tab in Preferences for SSH and SCP paths, timeout and password caching.
• GUI: Rules menu with insert, move, copy, cut, paste, remove, disable and enable.

Changed

• Compiler (iptables, nftables): timestamps are gone from the generated scripts, so a deployment is idempotent.
• GUI: default label colours use the Solarized palette; "Purple" is now "Cluster" and "Gray" is now "Maintenance".
• GUI: FirewallFabrik runs natively on Wayland; the XCB fallback is gone.
• GUI: the "Unprotected interface" checkbox is gone from the interface editor, as it does not apply to iptables or nftables.

Fixed

• Compiler (iptables, nftables): shadowing detection reports a warning instead of aborting the compilation, and no longer treats an address range as "any".

v1.2.0 - 2026-03-17

Added

• Compiler (iptables, nftables): full Firewall Builder compiler parity, NFLOG as a logging target, and nftables load balancing and address set merging (closes #18, #22, #23, #24).
• GUI: a compile log error is clickable and scrolls to the firewall section it belongs to (closes #15).
• GUI: Cluster Member Management dialog to add and remove firewalls and view interface mappings (closes #26).
• GUI: Import Addresses from File, Library Import from .fwf or .fwb, and Library Export to a separate .fwf file (closes #12, #27).
• GUI: Inspect Rules shows all rules referencing the selected object (closes #28).
• GUI: Preferences dialog with DNS Name, Address Table, Policy Rules and Interface tabs, and Restore Defaults.
• Standard service library: Bareos, Keycloak, Kibana, Libvirt, Logstash, OpenSearch.

Changed

• Compiler (iptables): the generated script runs nft flush ruleset on systems where nft is available.

Fixed

• Compiler (iptables): the generated script carries the actual package version.
• Compiler (iptables, nftables): multiport rules were broken because the TCP flag check matched all TCP services (fixes #21).
• Compiler (iptables, nftables): no more false-positive shadowing errors.
• GUI: MAC address edits are saved instead of being silently ignored (fixes #14).
• GUI: opening an object for editing no longer marks the file as modified when nothing changed (fixes #25).

v1.1.0 - 2026-03-16

Added

• Compiler (iptables): DSCP symbolic class names such as AF11, EF or CS3, and version-aware ipv4options formatting for releases before and after iptables 1.4.3.
• Compiler (iptables): fragment matching and IPv4 option matching in the filter compiler, which only the NAT compiler had.
• Compiler (iptables, nftables): the router-alert IP option.
• Compiler (nftables): DiffServ matching through ip dscp and ip tos.

Changed

• GUI: the DiffServ default is DSCP instead of TOS.

Fixed

• Compiler (iptables): TCP flag matching.
• Compiler (iptables, nftables): ICMP type and code matching in NAT rules.
• Compiler (iptables, nftables): no more shadowing false positives for IP services such as VRRP.

v1.0.1 - 2026-03-11

Fixed

• The platform YAML defaults are part of the pip package again.

v1.0.0 - 2026-03-08

Added

• CLI: fwf-ipt and fwf-nft accept several firewall names and --all.
• GUI: "Resolve Name" in the IPv4 and IPv6 address dialogs.
• GUI: a confirm-delete dialog for objects that are still in use.
• GUI: DynamicGroup editor with criteria table and matched-objects preview.
• GUI: File > Reload re-reads the current file from disk.
• GUI: NAT and Routing rule display, title bar dirty-state indicator, and a Window menu.
• GUI: parallel compilation of several firewalls, with ordered log output.
• GUI: subfolder paste, drag and drop, and nested object creation in the object tree.
• GUI: system theme icons (Breeze, Adwaita and others) for the toolbar and menus.
• MIME type definitions for .fwf and .fwb files.
• Standard service library: Collabora Online, FreeIPA, Icinga, Nextcloud notify_push, WinRM.

Fixed

• Compiler (iptables, nftables): a firewall imported from a .fwb file compiles and installs without a prior save, and its Linux host settings reach the compiler.
• Compiler (iptables, nftables): rule shadowing detection is on by default, and its messages name the rule position.
• Compiler (nftables): tcp flags != syn ct state new drop is generated when "Accept new TCP with no SYN" is off.
• GUI: .fwb import detects the legacy Firewall Builder compiler paths and offers to clear them, so FirewallFabrik uses its built-in compiler.
• GUI: a new object created from the toolbar menu lands in the selected custom folder.
• GUI: dead menu entries are gone (File Compare, SNMP Discovery, Policy Import, Print, Help Contents and Index).
• GUI: deleting an object works regardless of how it is referenced.
• GUI: DynamicGroup, AddressTable and DNSName objects are allowed in rule source and destination cells.
• GUI: Find and Replace scope, tree filter and element display.
• GUI: the last active rule set is remembered by name, which survives an import.

v0.5.0rc1 - 2026-02-13

Added

• GUI: an asterisk in the title bar when the file has unsaved changes.
• GUI: CIDR notation in the IPv4 and IPv6 editor dialogs.
• GUI: firewalls needing recompilation are shown in bold in the object tree.
• GUI: input validation in all editor dialogs.
• GUI: RuleSet editor dialog for Policy, NAT and Routing.

Fixed

• GUI: Compile, Install and Save are disabled when no file is loaded.
• GUI: saving an imported .fwb warns before overwriting an existing .fwf.
• GUI: the Host OS and Platform Settings dialogs disable the options the compiler does not support.
• Installer: the remote paths and file names are correct.

v0.5.0b1 - 2026-02-13

Initial public beta pre-release.

Added

• Compile and install workflow for iptables and nftables.
• GUI: detailed object tooltips in the rule editor.
• GUI: host wizard and group dialog ported from Firewall Builder.
• GUI: MDI rule set windows with multi-select drag, clipboard, delete and context menu.
• GUI: nftables settings dialog.
• GUI: object tree with library folder structure and nested group placement.
• GUI: single-rule compile for the target platform.
• Standard service library expanded with the Wikipedia multi-service ports.