From: Michael Olbrich <m.olbrich@pengutronix.de>
To: ptxdist@pengutronix.de
Subject: Re: [ptxdist] [PATCH] Add persistant iptable-rules via systemd
Date: Thu, 7 Apr 2016 14:24:24 +0200 [thread overview]
Message-ID: <20160407122424.GB9738@pengutronix.de> (raw)
In-Reply-To: <1460023804-5523-1-git-send-email-g.schenk@eckelmann.de>
On Thu, Apr 07, 2016 at 12:10:04PM +0200, Gavin Schenk wrote:
> Supports ipv4 and ipv6 and both options can be selected in menuconfig IPTABLES_IPV6_SYSTEMD_UNIT and IPTABLES_IPV4_SYSTEMD_UNIT
>
> If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from file /etc/iptables/rules.v4.
> If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from the file /etc/iptables/rules.v6.
> You have to provide this files. Both files can easily be generated with the utils iptables-save ip6tables-save from the iptables package.
>
> e.g: Generating a rulefile, that drops port 5000 on interface eth0 ipv4
> 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP
> 2.) iptables-save > /etc/iptables/rules.v4
>
> The basic idea was taken from https://github.com/gronke/systemd-iptables written by Stefan Grönke in 2015.
> ---
> .../0001-Added-files-for-systemd-support.patch | 115 +++++++++++++++++++++
> patches/iptables-1.4.21/series | 4 +
> rules/iptables.in | 10 ++
> rules/iptables.make | 17 +++
> 4 files changed, 146 insertions(+)
> create mode 100644 patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
> create mode 100644 patches/iptables-1.4.21/series
>
> diff --git a/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
> new file mode 100644
> index 0000000..e98a788
> --- /dev/null
> +++ b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch
> @@ -0,0 +1,115 @@
> +From: Gavin Schenk <g.schenk@eckelmann.de>
> +Date: Wed, 6 Apr 2016 10:19:52 +0200
> +Subject: [PATCH] Added files for systemd support
> +
> +---
> + etc/iptables/rules.v4 | 0
> + etc/iptables/rules.v6 | 0
> + scripts/ip6tables-flush | 19 +++++++++++++++++++
> + scripts/iptables-flush | 19 +++++++++++++++++++
> + systemd/system/ip6tables.service | 14 ++++++++++++++
> + systemd/system/iptables.service | 14 ++++++++++++++
Please put these files into projectroot/ instead and use
install_alternative for all of them.
Michael
> + 6 files changed, 66 insertions(+)
> + create mode 100644 etc/iptables/rules.v4
> + create mode 100644 etc/iptables/rules.v6
> + create mode 100755 scripts/ip6tables-flush
> + create mode 100755 scripts/iptables-flush
> + create mode 100755 systemd/system/ip6tables.service
> + create mode 100755 systemd/system/iptables.service
> +
> +diff --git a/etc/iptables/rules.v4 b/etc/iptables/rules.v4
> +new file mode 100644
> +index 000000000000..e69de29bb2d1
> +diff --git a/etc/iptables/rules.v6 b/etc/iptables/rules.v6
> +new file mode 100644
> +index 000000000000..e69de29bb2d1
> +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush
> +new file mode 100755
> +index 000000000000..cf6d22bb2923
> +--- /dev/null
> ++++ b/scripts/ip6tables-flush
> +@@ -0,0 +1,19 @@
> ++#!/bin/sh
> ++
> ++if ! ip6tables --list >/dev/null 2>&1; then
> ++ echo "ipv6 filtering is not supported by the running kernel."
> ++ exit 3
> ++fi
> ++
> ++ip6tables -F
> ++ip6tables -X
> ++ip6tables -Z
> ++for table in $(</proc/net/ip6_tables_names)
> ++do
> ++ ip6tables -t $table -F
> ++ ip6tables -t $table -X
> ++ ip6tables -t $table -Z
> ++done
> ++ip6tables -P INPUT ACCEPT
> ++ip6tables -P OUTPUT ACCEPT
> ++ip6tables -P FORWARD ACCEPT
> +diff --git a/scripts/iptables-flush b/scripts/iptables-flush
> +new file mode 100755
> +index 000000000000..a6e056f31a75
> +--- /dev/null
> ++++ b/scripts/iptables-flush
> +@@ -0,0 +1,19 @@
> ++#!/bin/sh
> ++
> ++if ! iptables --list >/dev/null 2>&1; then
> ++ echo "ipv4 filtering is not supported by the running kernel."
> ++ exit 3
> ++fi
> ++
> ++iptables -F
> ++iptables -X
> ++iptables -Z
> ++for table in $(</proc/net/ip_tables_names)
> ++do
> ++ iptables -t $table -F
> ++ iptables -t $table -X
> ++ iptables -t $table -Z
> ++done
> ++iptables -P INPUT ACCEPT
> ++iptables -P FORWARD ACCEPT
> ++iptables -P OUTPUT ACCEPT
> +diff --git a/systemd/system/ip6tables.service b/systemd/system/ip6tables.service
> +new file mode 100755
> +index 000000000000..e842cc1973a1
> +--- /dev/null
> ++++ b/systemd/system/ip6tables.service
> +@@ -0,0 +1,14 @@
> ++[Unit]
> ++Description=Packet Filtering Framework
> ++DefaultDependencies=no
> ++After=systemd-sysctl.service
> ++Before=sysinit.target
> ++ConditionFileNotEmpty=/etc/iptables/rules.v6
> ++[Service]
> ++Type=oneshot
> ++ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
> ++ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6
> ++ExecStop=/usr/sbin/iptables/ip6tables-flush
> ++RemainAfterExit=yes
> ++[Install]
> ++WantedBy=multi-user.target
> +diff --git a/systemd/system/iptables.service b/systemd/system/iptables.service
> +new file mode 100755
> +index 000000000000..fa4a8b367ca0
> +--- /dev/null
> ++++ b/systemd/system/iptables.service
> +@@ -0,0 +1,14 @@
> ++[Unit]
> ++Description=Packet Filtering Framework
> ++DefaultDependencies=no
> ++After=systemd-sysctl.service
> ++Before=sysinit.target
> ++ConditionFileNotEmpty=/etc/iptables/rules.v4
> ++[Service]
> ++Type=oneshot
> ++ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4
> ++ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4
> ++ExecStop=/usr/sbin/iptables-flush
> ++RemainAfterExit=yes
> ++[Install]
> ++WantedBy=multi-user.target
> diff --git a/patches/iptables-1.4.21/series b/patches/iptables-1.4.21/series
> new file mode 100644
> index 0000000..b8f388f
> --- /dev/null
> +++ b/patches/iptables-1.4.21/series
> @@ -0,0 +1,4 @@
> +# generated by git-ptx-patches
> +#tag:base --start-number 1
> +0001-Added-files-for-systemd-support.patch
> +# 366b7fd90bb4fe7e229f0ba777703fb5 - git-ptx-patches magic
> diff --git a/rules/iptables.in b/rules/iptables.in
> index e6f3699..8354060 100644
> --- a/rules/iptables.in
> +++ b/rules/iptables.in
> @@ -25,6 +25,16 @@ config IPTABLES_IPV4
> bool
> prompt "IPv4 support"
>
> +config IPTABLES_IPV6_SYSTEMD_UNIT
> + bool
> + prompt "Activate IPv6 systemd service unit"
> + select IPTABLES_IPV6
> +
> +config IPTABLES_IPV4_SYSTEMD_UNIT
> + bool
> + prompt "Activate IPv4 systemd service unit"
> + select IPTABLES_IPV4
> +
> config IPTABLES_LIBIPQ
> bool
> prompt "Enable libipq"
> diff --git a/rules/iptables.make b/rules/iptables.make
> index 8a1ea66..12d3867 100644
> --- a/rules/iptables.make
> +++ b/rules/iptables.make
> @@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4
> @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-restore)
> @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save)
> endif
> +
> +ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT
> +# # IPv6 systemd service unit part
> + @$(call install_copy, iptables, 0, 0, 0755, $(IPTABLES_DIR)/scripts/ip6tables-flush, /usr/sbin/ip6tables-flush)
> + @$(call install_copy, iptables, 0, 0, 0644, $(IPTABLES_DIR)/systemd/system/ip6tables.service, /lib/systemd/system/ip6tables.service)
> + @$(call install_link, iptables, ../ip6tables.service, /lib/systemd/system/multi-user.target.wants/ip6tables.service)
> + @$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v6)
> +endif
> +
> +ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT
> +# # IPv4 systemd service unit part
> + @$(call install_copy, iptables, 0, 0, 0755, $(IPTABLES_DIR)/scripts/iptables-flush, /usr/sbin/iptables-flush)
> + @$(call install_copy, iptables, 0, 0, 0644, $(IPTABLES_DIR)/systemd/system/iptables.service, /lib/systemd/system/iptables.service)
> + @$(call install_link, iptables, ../iptables.service, /lib/systemd/system/multi-user.target.wants/iptables.service)
> + @$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v4)
> +endif
> +
> endif
>
> ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY
> --
> 1.9.1
>
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
--
Pengutronix e.K. | |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
next prev parent reply other threads:[~2016-04-07 12:24 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-07 10:10 Gavin Schenk
2016-04-07 11:59 ` Uwe Kleine-König
2016-04-07 12:24 ` Michael Olbrich [this message]
-- strict thread matches above, loose matches on Subject: below --
2016-04-11 12:19 Gavin Schenk
2016-04-11 17:46 ` Uwe Kleine-König
2016-04-12 8:35 ` Michael Olbrich
2016-04-08 13:04 Gavin Schenk
2016-04-11 10:00 ` Michael Olbrich
2016-04-11 12:08 ` Schenk, Gavin
2016-04-11 12:44 ` Michael Olbrich
2016-04-07 12:21 Gavin Schenk
2016-04-07 7:24 Gavin Schenk
2016-04-07 8:11 ` Uwe Kleine-König
2016-04-07 9:14 ` Schenk, Gavin
2016-04-07 9:20 ` Uwe Kleine-König
2016-04-07 9:25 ` Schenk, Gavin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160407122424.GB9738@pengutronix.de \
--to=m.olbrich@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox