Fallback to accepting only NEW output public traffic if conntrack netlink isn't supported

internal/firewall/iptables/firewall.go

@@ -2,9 +2,12 @@ package iptables
 
 import (
 	"context"
+	"errors"
 	"sync"
 )
 
+var ErrKernelModuleMissing = errors.New("kernel module is missing for this operation")
+
 type Config struct {
 	runner         CmdRunner
 	logger         Logger
@@ -14,6 +17,7 @@ type Config struct {
 	// Fixed state
 	ipTables  string
 	ip6Tables string
+	modules   kernelModules
 }
 
 func New(ctx context.Context, runner CmdRunner, logger Logger) (*Config, error) {
@@ -32,5 +36,6 @@ func New(ctx context.Context, runner CmdRunner, logger Logger) (*Config, error)
 		logger:    logger,
 		ipTables:  iptables,
 		ip6Tables: ip6tables,
+		modules:   newKernelModules(),
 	}, nil
 }