Add a dry-run option that outputs the new rules to stdout but doesn't modify anything

[CristianCantoro]

Hi,

this is a request for an enhancement. The idea is to add a --dry-run option that outputs the new rules to stdout without actually changing anything, that would be useful to check the output of the command before actually running it.

[rpthms]

Dry run shouldn't be too hard. We could set the geo-filter table to dormant right from the get go (that way it's rules will never be evaulated), then add the IP block sets and rules as usual, then print out the ruleset and delete the geo-filter table.

[andrey-utkin]

I think the point is to work successfully even if it's impossible to run nft. That way I could

• familiarise with how the result actually look
• transform its output in some custom way
• make sanity checks on the resulting blocked set

all before affecting the actual configuration. Potentially before the target machine even boots.