Package: iptables-persistent Version: 1.0.11 Severity: normal Dear Maintainer,
I have a common iptables rule file for both ipv4 and ipv6, when I tried to restart the netfilter-persistent, it internally calls the iptables-restore and ip6tables-restore. during ip6tables-restore, it failed because it couldn't understand the below rule -4 -A INPUT -p icmp -j ACCEPT I tried running the same rule file with ip6table-legacy-restore, it worked fine, but by default in Debian buster it calls the ip6table-nft-restore, which is failing to understand the rule with -4 option in it. Below is the complete rule file content ========================= root@rs-dal-karthik-test:/etc/iptables# cat rules.test # Base iptables rules loaded from Ansible *filter # Policy defaults :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] # allow outbound traffic by default # Allow connections that are already-established or related to an # established connection -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow ICMP -4 -A INPUT -p icmp -j ACCEPT # Allow ICMPv6 -6 -A INPUT -p ipv6-icmp -j ACCEPT # Allow internal traffic on loopback device -A INPUT -i lo -j ACCEPT # Rate limit SSH -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name RateLimitSsh --rsource -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name RateLimitSsh --rsource -j DROP -A INPUT -p tcp --dport 22 -j ACCEPT COMMIT root@rs-dal-karthik-test:/etc/iptables# ================================ Below is the output when I run the ip6table-legacy-restore and ip6table-nft-restore root@rs-dal-karthik-test:/etc/iptables# ip6tables-legacy-restore rules.test root@rs-dal-karthik-test:/etc/iptables# ip6tables-nft-restore rules.test Error occurred at line: 15 Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information. root@rs-dal-karthik-test:/etc/iptables# root@rs-dal-karthik-test:/etc/iptables# ip6tables-restore rules.test Error occurred at line: 15 Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information. root@rs-dal-karthik-test:/etc/iptables# The expectation is if the ip6tables-legacy-restore is successful, the ip6tables-nft-restore should also be successful, but why is it failing? -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-2-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages iptables-persistent depends on: ii debconf [debconf-2.0] 1.5.71 ii iptables 1.8.2-4 ii netfilter-persistent 1.0.11 iptables-persistent recommends no packages. iptables-persistent suggests no packages. -- debconf-show failed
