Update nftables

README.md

@@ -119,6 +119,29 @@ Options:
 
 > Prefix: `skale node`
 
+#### Configure firewall
+
+Firewall setup does not automatically open monitoring ports 9100 and 8080.
+Reconfiguration removes their legacy allow rules from the managed base chain
+and saves the updated rules for reboot. `MONITORING_CONTAINERS` controls the
+containers only; the firewall's `--monitoring` option has been removed.
+Explicit rules in `/etc/nft.conf.d/skale/user.conf` remain under operator control.
+
+SSH allow rules use all listening ports reported by `sshd -T`, including ports
+configured through included files and `ListenAddress`. If detection fails, the
+command stops before enabling the default-drop policy.
+
+For a port configured through sshd command-line options or socket activation,
+set the `SSH_PORT` environment variable explicitly when running commands that
+configure the firewall (including node init and update):
+
+```shell
+sudo SSH_PORT=2222 skale node configure-firewall
+```
+
+The override replaces automatic detection and accepts one port from 1 to 65535.
+It must be passed in the command environment, not only in the node settings file.
+
 #### Node information
 
 Get base info about the standard SKALE node.

node_cli/cli/node.py

@@ -239,16 +239,15 @@ def check(network):
 
 
 @node.command(help='Reconfigure nftables rules')
-@click.option('--monitoring', is_flag=True)
 @click.option(
     '--yes',
     is_flag=True,
     callback=abort_if_false,
     expose_value=False,
     prompt='Are you sure you want to reconfigure firewall rules?',
 )
-def configure_firewall(monitoring):
-    configure_firewall_rules(enable_monitoring=monitoring)
+def configure_firewall():
+    configure_firewall_rules()
 
 
 @node.command(help='Show node version information')