Staging Vessel Firewall Policies with Shadow Chains
Staging a firewall change should not suspend the policy already protecting a vessel. This follow-up examines shadow enforcement in nftables: testing a candidate alongside the active policy, and four design traps that could let observation alter live traffic.