Stephen Satchell <list@xxxxxxxxxxxx> writes: > One thing I would love is a way of injecting packets into a userland > test tool that reports what nftables did with it. If I had such a > tool, I would be more inclined to use a 0.x version because I could > verify that the code plus ruleset is doing what it's supposed to do. Can't you use "ip netns" (or systemd-nspawn, or docker, or libvirt-qemu) to set up a test network with a test firewall, then send packets into / out of that test environment? OK, it's a bit fiddly to set up, but I don't see why you need any special nftables-specific thing when you can just do regular namespace/container/vm techniques.
