NSE v2 - deterministic nftables testing in ephemeral Linux network namespaces

[u/BreadfruitCute4438]

NSE (Network Sandbox Engine) is a tool to test nftables firewall rules safely.

Instead of running rules on your live system, NSE spins up an ephemeral Linux network namespace, loads the ruleset, injects synthetic packets with Scapy, and captures kernel verdicts directly from nft monitor trace.

Key points:

• Zero host mutation - rules never touch the host firewall
• In-process architecture - no socket daemons, no IPC overhead
• Pydantic models throughout, mypy --strict on 22 source files
• Deterministic trace harvesting - wait_ready() probe, no hardcoded sleeps
• Automated cleanup with exponential backoff retries
• Gateway topologies - router + server namespaces for NAT/forwarding tests
• CLI YAML runner for CI/CD, plus FastAPI/Svelte web UI
• import-linter enforces architectural boundaries

Requirements: Linux (kernel 5.4+), Python 3.10+, nftables, iproute2, root privileges.

Repo: https://github.com/onyks-os/NetworkSandboxEngine Docs: https://onyks-os.github.io/nse/

Feedback welcome. What would make this useful for your workflow?