Summary

Add an option that, if present, allows the system to pass traffic while the boot config is still loading or has failed to load.

For example,

set system option allow-traffic-before-fully-booted

If that option is absent, disable IPv4 and IPv6 forwarding and add provisional nftables rules to block all traffic before starting to load the config, and only remove those restrictions when the config is successfully loaded.

Use case

At the moment, the config system makes a strict assumption that if it cannot successfully load the whole config, it should load everything it can. Usually that is fine because it gives end users a partially functional system (e.g., it can't give out DHCP leases but at least it can route traffic from systems that already have addresses) and gives the admin a chance to log in over SSH and fix the rest.

But there are cases when that assumption is wrong. For example, if the system's primary role is firewall, and it manages to load interfaces and routes but fails to apply firewall rules, it will be passing all traffic without filtering — thus failing to fulfill its intended role.

Making the system become completely inaccessible over the network on any config failure would be a radical departure from the behavior that has been there for over a decade. Some people may be relying on that behavior for the case of non-fatal failures and may not have out-of-band management ready.

But an option that is inserted into old configs by a migration script to preserve the old behavior can be a suitable first step.