Just for the record, my friend @giacomo worked on an annoying NethServer problem, reported many times here in community: the administrator can configure the server as a gateway only after installing the shorewall component
NethServer has two firewall implementations:
lokkit used when the server is server-only (only green interfaces)
shorewall when the server is server and gateway (green/red/orange/blue interfaces)
Both implementations are complicating the code and have a big drawback: the administrator can configure the server as a gateway only after installing the shorewall component.
Shorewall must be included inside the core system (and the ISO), lokkit implementation will be removed.