[ptxdist] [PATCH] Add persistant iptable-rules via systemd

[Gavin Schenk <g.schenk@eckelmann.de>]

Supports ipv4 and ipv6 and both options can be selected in menuconfig
by IPTABLES_IPV6_SYSTEMD_UNIT and/or IPTABLES_IPV4_SYSTEMD_UNIT

If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on
multiuser.target that set the iptable rules from file:
/etc/iptables/rules.v4

If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on
multiuser.target that set the iptable rules from the file:
/etc/iptables/rules.v6

The Package provides empty files. If you want to add custom rules, you
have to provide your own files. The rule files can be generated with
the utils iptables-save ip6tables-save from the iptables package.

Example:
Generating a rule file, that drops port 5000 on interface eth0 for ipv4

1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP
2.) iptables-save > /etc/iptables/rules.v4

The basic idea was taken from https://github.com/gronke/systemd-iptables
written by Stefan Grönke <stefan@gronke.net> in 2015.

Signed-off-by: Gavin Schenk <g.schenk@eckelmann.de>
---
 projectroot/etc/iptables/rules.v4                |  0
 projectroot/etc/iptables/rules.v6                |  0
 projectroot/lib/systemd/system/ip6tables.service | 14 ++++++++++++++
 projectroot/lib/systemd/system/iptables.service  | 14 ++++++++++++++
 projectroot/usr/sbin/ip6tables-flush             | 19 +++++++++++++++++++
 projectroot/usr/sbin/iptables-flush              | 19 +++++++++++++++++++
 rules/iptables.in                                | 10 ++++++++++
 rules/iptables.make                              | 17 +++++++++++++++++
 8 files changed, 93 insertions(+)
 create mode 100644 projectroot/etc/iptables/rules.v4
 create mode 100644 projectroot/etc/iptables/rules.v6
 create mode 100644 projectroot/lib/systemd/system/ip6tables.service
 create mode 100644 projectroot/lib/systemd/system/iptables.service
 create mode 100755 projectroot/usr/sbin/ip6tables-flush
 create mode 100755 projectroot/usr/sbin/iptables-flush

diff --git a/projectroot/etc/iptables/rules.v4 b/projectroot/etc/iptables/rules.v4
new file mode 100644
index 0000000..e69de29
diff --git a/projectroot/etc/iptables/rules.v6 b/projectroot/etc/iptables/rules.v6
new file mode 100644
index 0000000..e69de29
diff --git a/projectroot/lib/systemd/system/ip6tables.service b/projectroot/lib/systemd/system/ip6tables.service
new file mode 100644
index 0000000..e842cc1
--- /dev/null
+++ b/projectroot/lib/systemd/system/ip6tables.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Packet Filtering Framework
+DefaultDependencies=no
+After=systemd-sysctl.service
+Before=sysinit.target
+ConditionFileNotEmpty=/etc/iptables/rules.v6
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
+ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
+ExecStop=/usr/sbin/iptables/ip6tables-flush
+RemainAfterExit=yes
+[Install]
+WantedBy=multi-user.target
diff --git a/projectroot/lib/systemd/system/iptables.service b/projectroot/lib/systemd/system/iptables.service
new file mode 100644
index 0000000..fa4a8b3
--- /dev/null
+++ b/projectroot/lib/systemd/system/iptables.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Packet Filtering Framework
+DefaultDependencies=no
+After=systemd-sysctl.service
+Before=sysinit.target
+ConditionFileNotEmpty=/etc/iptables/rules.v4
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4
+ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4
+ExecStop=/usr/sbin/iptables-flush
+RemainAfterExit=yes
+[Install]
+WantedBy=multi-user.target
diff --git a/projectroot/usr/sbin/ip6tables-flush b/projectroot/usr/sbin/ip6tables-flush
new file mode 100755
index 0000000..cf6d22b
--- /dev/null
+++ b/projectroot/usr/sbin/ip6tables-flush
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+if ! ip6tables --list >/dev/null 2>&1; then
+        echo "ipv6 filtering is not supported by the running kernel."
+        exit 3
+fi
+
+ip6tables -F
+ip6tables -X
+ip6tables -Z
+for table in $(</proc/net/ip6_tables_names)
+do
+        ip6tables -t $table -F
+        ip6tables -t $table -X
+        ip6tables -t $table -Z
+done
+ip6tables -P INPUT ACCEPT
+ip6tables -P OUTPUT ACCEPT
+ip6tables -P FORWARD ACCEPT
diff --git a/projectroot/usr/sbin/iptables-flush b/projectroot/usr/sbin/iptables-flush
new file mode 100755
index 0000000..a6e056f
--- /dev/null
+++ b/projectroot/usr/sbin/iptables-flush
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+if ! iptables --list >/dev/null 2>&1; then
+	echo "ipv4 filtering is not supported by the running kernel." 	
+	exit 3
+fi 
+
+iptables -F
+iptables -X
+iptables -Z
+for table in $(</proc/net/ip_tables_names)
+do
+        iptables -t $table -F
+        iptables -t $table -X
+        iptables -t $table -Z
+done
+iptables -P INPUT ACCEPT
+iptables -P FORWARD ACCEPT
+iptables -P OUTPUT ACCEPT
diff --git a/rules/iptables.in b/rules/iptables.in
index e6f3699..8354060 100644
--- a/rules/iptables.in
+++ b/rules/iptables.in
@@ -25,6 +25,16 @@ config IPTABLES_IPV4
 	bool
 	prompt "IPv4 support"
 
+config IPTABLES_IPV6_SYSTEMD_UNIT
+	bool
+	prompt "Activate IPv6 systemd service unit"
+	select IPTABLES_IPV6
+
+config IPTABLES_IPV4_SYSTEMD_UNIT
+	bool
+	prompt "Activate IPv4 systemd service unit"
+	select IPTABLES_IPV4
+
 config IPTABLES_LIBIPQ
 	bool
 	prompt "Enable libipq"
diff --git a/rules/iptables.make b/rules/iptables.make
index 8a1ea66..3dff774 100644
--- a/rules/iptables.make
+++ b/rules/iptables.make
@@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4
 	@$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-restore)
 	@$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save)
 endif
+
+ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT
+# 	# IPv6 systemd service unit part
+	@$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v6)
+	@$(call install_alternative, iptables, 0, 0, 0755, /usr/sbin/ip6tables-flush)
+	@$(call install_alternative, iptables, 0, 0, 0644, /lib/systemd/system/ip6tables.service)
+	@$(call install_link, iptables, ../ip6tables.service, /lib/systemd/system/multi-user.target.wants/ip6tables.service)
+endif
+
+ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT
+# 	# IPv4 systemd service unit part
+	@$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v4)
+	@$(call install_alternative, iptables, 0, 0, 0755, /usr/sbin/iptables-flush)
+	@$(call install_alternative, iptables, 0, 0, 0644, /lib/systemd/system/iptables.service)
+	@$(call install_link, iptables, ../iptables.service, /lib/systemd/system/multi-user.target.wants/iptables.service)
+endif
+
 endif
 
 ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY
-- 
1.9.1


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de