FIREWALL_IMPLEMENTATION option

internal/firewall/firewall.go

@@ -7,6 +7,7 @@ import (
 	"sync"
 
 	"github.com/qdm12/gluetun/internal/firewall/iptables"
+	"github.com/qdm12/gluetun/internal/firewall/nftables"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/routing"
 )
@@ -33,14 +34,25 @@ type Config struct {
 }
 
 // NewConfig creates a new Config instance and returns an error
-// if no iptables implementation is available.
-func NewConfig(ctx context.Context, logger Logger,
+// if no firewall implementation is available.
+func NewConfig(ctx context.Context, implementation string, logger Logger,
 	runner CmdRunner, defaultRoutes []routing.DefaultRoute,
 	localNetworks []routing.LocalNetwork,
 ) (config *Config, err error) {
-	impl, err := iptables.New(ctx, runner, logger)
-	if err != nil {
-		return nil, fmt.Errorf("creating iptables firewall: %w", err)
+	var impl firewallImpl
+	var customRulesPath string
+	switch implementation {
+	case "iptables":
+		impl, err = iptables.New(ctx, runner, logger)
+		if err != nil {
+			return nil, fmt.Errorf("creating iptables firewall: %w", err)
+		}
+		customRulesPath = "/iptables/post-rules.txt"
+	case "nftables":
+		impl = nftables.New(logger)
+		customRulesPath = "/gluetun/firewall/nftables/post-rules.txt"
+	default:
+		return nil, fmt.Errorf("unknown firewall implementation: %s", implementation)
 	}
 
 	return &Config{
@@ -51,6 +63,6 @@ func NewConfig(ctx context.Context, logger Logger,
 		defaultRoutes:   defaultRoutes,
 		localNetworks:   localNetworks,
 		impl:            impl,
-		customRulesPath: "/iptables/post-rules.txt",
+		customRulesPath: customRulesPath,
 	}, nil
 }