Coexistence
Works with what you already use.
atalince doesn't replace your firewall. It creates its own chains, puts the jumps in the right place and leaves your rules as they are.
01Firewall order
What comes before, what comes after.
Since agent 1.0.2, atalince's jumps go right after rules that only drop traffic and ahead of any rule that may accept. A blocked IP can't slip through an earlier ACCEPT, and nobody fights over the first position.
INPUT · jump order
- 1f2b-sshddrop onlystays in front
- 2ATALINCE-BANSatalinceblocked IPs → DROP
- 3ATALINCE-INPUTatalinceallowed IPs, rules, geoblocking
- 4ufw-before-inputmay acceptcomes after
- ufw
- ufw rules are not changed.
- firewalld
- If a reload removes the jump to atalince's chain, the agent puts it back.
- CSF
- CSF rules stay as they are.
- fail2ban
- The f2b-* chains only drop; atalince goes right after them.
- CrowdSec
- With the iptables firewall bouncer, atalince goes right after its chains.
- mailcow
- atalince goes right after the MAILCOW chain, without fighting for position.
- Docker
- Published ports go through FORWARD. The agent keeps two jumps at the top of DOCKER-USER (since 1.0.4), or of FORWARD with Docker's nftables backend (since 1.0.7).
- Coolify and Compose
- They publish ports through Docker, so they are covered the same way.
- Manual DROPs
- Your own drop-only rules stay in front.
03On the way out
Uninstalling takes nothing of yours.
Removed
- The atalince-agent binary and the systemd service
- The ATALINCE-INPUT and ATALINCE-BANS chains and the atalince-* sets
- The agent's local state
Stays
- Your firewall rules, including ufw, firewalld or CSF rules
- Your files and logs
Founders program
Use atalince from the start.
Pro features for up to 3 servers, free of charge, for 12 months. Every application is reviewed by the team.