The source user had a real IPv6 security problem: their ISP moved them to MAP-E, ordinary IPv4 port forwarding was no longer useful, and the services were reachable through IPv6. They needed one inbound UDP port for a VPN but did not want to expose every ZimaOS service to the public Internet.
The thread also contains an important correction. A community responder initially claimed the nft command was already present. The original poster tested the system and found neither the binary nor the expected configuration files. The responder then withdrew the claim, and another user correctly summarized the platform distinction: Buildroot, not Debian.
The 2025 Source Had No Built-In Firewall Rule Editor
The original poster could not find a WebUI or CLI rule editor that allowed an explicit IPv6 allowlist/denylist. They wanted to expose only a VPN UDP port while blocking other unsolicited Internet traffic.
The public thread contains no IceWhale staff reply announcing a native firewall UI.
The First nftables Advice Was Wrong for That ZimaOS Build
A community responder assumed that because many Linux distributions ship nft, ZimaOS did too. The source user tested:
-
sudo nft; -
sudo /usr/sbin/nft; - the expected nftables configuration path.
None existed. The responder explicitly corrected their earlier answer.
ZimaOS Is Not a Minimal Debian Installation
This matters because firewall tutorials often begin with apt install nftables or ufw. ZimaOS is Buildroot-based, has no normal APT package workflow, and keeps most of its system layer immutable.
Do not translate a generic Debian firewall guide into ZimaOS commands without confirming the binaries and persistence model on the current release.
Current Public Network Settings Still Focus on Interfaces, IP, DNS, and Remote Access
Current IceWhale networking documentation exposes physical Ethernet status, DHCP/manual IP configuration, gateway, DNS, and Remote Access. It does not publish a built-in custom firewall-rule workflow.
Use the current ZimaOS networking settings as the supported baseline.
Avoid Public Exposure When a Secure Tunnel Solves the Use Case
The source community suggested Tailscale or Cloudflare Tunnel for services that do not need to accept arbitrary inbound Internet traffic. Current ZimaOS also provides its own encrypted P2P Remote Access through ZimaClient.
A private tunnel reduces the number of services that need public IPv4/IPv6 listeners and avoids turning the NAS into a general-purpose edge firewall.
A VPN Listener Is the Harder Case
The original poster specifically needed an inbound VPN UDP port, so “never expose anything” did not answer the requirement. In that architecture, an upstream router/firewall with IPv6 filtering is often the cleanest security boundary because it can allow the VPN port and drop unrelated unsolicited traffic before it reaches ZimaOS.
The Community Later Built ZFW as a ZimaOS Host-Firewall Module
In May 2026, community developer Lintux released ZFW, a systemd-sysext host firewall with a dashboard tile. It provides native-port allowlists, Docker-published-port controls, IPv6-aware filtering, a live exposure view, and a timed Safe-Apply rollback mechanism.
Current releases continue to evolve alongside ZimaOS changes, including fixes for iptables backend changes and ZimaOS's own remote-access mesh. Review the current ZFW community project and compatibility notes before installing it.
ZFW Is Not an IceWhale Built-In Firewall
ZFW is substantial community software, but it operates at the host networking layer and can block SSH, the web terminal, Docker-published ports, or remote-access traffic if rules or version compatibility are wrong.
Keep local console access or another rollback path when testing any host-firewall extension.
Docker-Published Ports Need Special Attention
A host firewall that only filters ordinary INPUT traffic can miss container-published traffic depending on the Docker networking path. ZFW's design explicitly handles Docker's DOCKER-USER chain for this reason.
When exposing applications, inventory both native ZimaOS listeners and Docker-published ports instead of assuming one host-port list tells the whole story.
IPv6 Must Be Tested from an Actual External IPv6 Network
LAN testing can show everything working while public IPv6 exposure behaves differently. Validate the rule from a real external network and confirm that only the intended service/port is reachable.
ZimaOS Firewall FAQ
Was nftables available in the 2025 source build?
The original poster tested and found that the nft binary was not present; the responder corrected their earlier assumption.
Does current public ZimaOS documentation show a native custom firewall-rule UI?
The current networking guide documents interface/IP/DNS/remote-access controls, not a custom firewall rule editor.
Is ZFW an official IceWhale firewall?
No. It is a community host-firewall module and should be treated as third-party system software.
