#!/bin/sh
# Drop the ruleset again -- Debian's ExecStop=/usr/sbin/nft flush ruleset.
#
# Note what this means on a router: flushing leaves the machine with no
# filtering and no NAT at all, not with a default-deny. That is the upstream
# behaviour and stopping the service is an explicit act, but it is worth
# knowing before anyone types "svctl stop nftables" on a live gateway.
set -e

NFT=/usr/sbin/nft
[ -r /etc/default/nftables ] && . /etc/default/nftables

"${NFT}" flush ruleset
echo 'nftables: ruleset flushed'
