Re: [ptxdist] [PATCH] Add persistant iptable-rules via systemd

["Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>]

Hello,

On Thu, Apr 07, 2016 at 09:24:26AM +0200, Gavin Schenk wrote:
> Supports ipv4 and ipv6 and both options can be selected in menuconfig
> IPTABLES_IPV6_SYSTEMD_UNIT and IPTABLES_IPV4_SYSTEMD_UNIT
> 
> If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on
> multiuser.target that set the iptable rules from file
> /etc/iptables/rules.v4.
> If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on
> multiuser.target that set the iptable rules from the file
> /etc/iptables/rules.v6.

would it make sense to add a call to install_alternative for the rule
files?

> You have to provide this files. Both files can easily be generated
> with the utils iptables-save ip6tables-save from the iptables package.
> 
> e.g: Generating a rulefile, that drops port 5000 on interface eth0 ipv4
> 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP
> 2.) iptables-save > /etc/iptables/rules.v4
> ---
>  .../0001-Added-files-for-systemd-support.patch     | 93 ++++++++++++++++++++++
>  patches/iptables-1.4.21/series                     |  4 +
>  rules/iptables.in                                  | 10 +++
>  rules/iptables.make                                | 15 ++++
>  4 files changed, 122 insertions(+)
>  create mode 100644 patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
>  create mode 100644 patches/iptables-1.4.21/series
> 
> diff --git a/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
> new file mode 100644
> index 0000000..6b055f4
> --- /dev/null
> +++ b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
> @@ -0,0 +1,93 @@
> +From: Gavin Schenk <g.schenk@eckelmann.de>
> +Date: Wed, 6 Apr 2016 10:19:52 +0200
> +Subject: [PATCH] Added files for systemd support
> +
> +---
> + scripts/ip6tables-flush          | 13 +++++++++++++
> + scripts/iptables-flush           | 13 +++++++++++++
> + systemd/system/ip6tables.service | 14 ++++++++++++++
> + systemd/system/iptables.service  | 14 ++++++++++++++
> + 4 files changed, 54 insertions(+)
> + create mode 100755 scripts/ip6tables-flush
> + create mode 100755 scripts/iptables-flush
> + create mode 100755 systemd/system/ip6tables.service
> + create mode 100755 systemd/system/iptables.service
> +
> +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush
> +new file mode 100755
> +index 000000000000..95086b0470d3
> +--- /dev/null
> ++++ b/scripts/ip6tables-flush
> +@@ -0,0 +1,13 @@
> ++#!/bin/sh
> ++ip6tables -F
> ++ip6tables -X
> ++ip6tables -Z
> ++for table in $(</proc/net/ip6_tables_names)

What happens if there is no ipv6 iptables support in the kernel? Maybe
catch that with an error message?

> ++do
> ++        ip6tables -t $table -F
> ++        ip6tables -t $table -X
> ++        ip6tables -t $table -Z
> ++done
> ++ip6tables -P INPUT ACCEPT
> ++ip6tables -P OUTPUT ACCEPT
> ++ip6tables -P FORWARD ACCEPT

Best regards
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de