Re: [ptxdist] [PATCH] Add persistant iptable-rules via systemd

["Schenk, Gavin" <G.Schenk@eckelmann.de>]

Hi,

> > If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on
> > multiuser.target that set the iptable rules from file
> > /etc/iptables/rules.v4.
> > If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on
> > multiuser.target that set the iptable rules from the file
> > /etc/iptables/rules.v6.
> 
> would it make sense to add a call to install_alternative for the rule files?

Yes, but in this case i have to provide an empty default file. 
I have testet ConditionFileNotEmpty with an empty file and it works!

Loaded: loaded (/lib/systemd/system/iptables.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
Condition: start condition failed at Thu 2016-04-07 11:26:45 CEST; 3min 20s ago
           ConditionFileNotEmpty=/etc/iptables/rules.v4 was not met

I will add empty files rules.v4 and rules.v6 to the package.

> > +---
> > + scripts/ip6tables-flush          | 13 +++++++++++++
> > + scripts/iptables-flush           | 13 +++++++++++++
> > + systemd/system/ip6tables.service | 14 ++++++++++++++
> > +systemd/system/iptables.service  | 14 ++++++++++++++
> > + 4 files changed, 54 insertions(+)
> > + create mode 100755 scripts/ip6tables-flush  create mode 100755
> > +scripts/iptables-flush  create mode 100755
> > +systemd/system/ip6tables.service  create mode 100755
> > +systemd/system/iptables.service
> > +
> > +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush new
> > +file mode 100755 index 000000000000..95086b0470d3
> > +--- /dev/null
> > ++++ b/scripts/ip6tables-flush
> > +@@ -0,0 +1,13 @@
> > ++#!/bin/sh
> > ++ip6tables -F
> > ++ip6tables -X
> > ++ip6tables -Z
> > ++for table in $(</proc/net/ip6_tables_names)
> 
> What happens if there is no ipv6 iptables support in the kernel? Maybe catch
> that with an error message?
> 

This is what happens on both ipv4 and ipv6:
iptables-flush 
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
/usr/sbin/iptables-flush: line 5: /proc/net/ip_tables_names: No such file or directory
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.


What is a good way to detect if the kernel supports iptables? 
Instead of digging into /proc my idea is to add something like:

iptables --list &> /dev/null
IPTABLES_SUPPORT=$?

If [ $IPTABLES_SUPPORT -gt 0 ]; then
	echo "iptables is not supported by your kernel"
	exit $IPTABLES_SUPPORT
fi

What you think about this?

Regards
Gavin Schenk

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de