Hello, On Thu, Apr 07, 2016 at 09:24:26AM +0200, Gavin Schenk wrote: > Supports ipv4 and ipv6 and both options can be selected in menuconfig > IPTABLES_IPV6_SYSTEMD_UNIT and IPTABLES_IPV4_SYSTEMD_UNIT > > If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on > multiuser.target that set the iptable rules from file > /etc/iptables/rules.v4. > If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on > multiuser.target that set the iptable rules from the file > /etc/iptables/rules.v6.
would it make sense to add a call to install_alternative for the rule files? > You have to provide this files. Both files can easily be generated > with the utils iptables-save ip6tables-save from the iptables package. > > e.g: Generating a rulefile, that drops port 5000 on interface eth0 ipv4 > 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP > 2.) iptables-save > /etc/iptables/rules.v4 > --- > .../0001-Added-files-for-systemd-support.patch | 93 > ++++++++++++++++++++++ > patches/iptables-1.4.21/series | 4 + > rules/iptables.in | 10 +++ > rules/iptables.make | 15 ++++ > 4 files changed, 122 insertions(+) > create mode 100644 > patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > create mode 100644 patches/iptables-1.4.21/series > > diff --git > a/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > new file mode 100644 > index 0000000..6b055f4 > --- /dev/null > +++ b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > @@ -0,0 +1,93 @@ > +From: Gavin Schenk <[email protected]> > +Date: Wed, 6 Apr 2016 10:19:52 +0200 > +Subject: [PATCH] Added files for systemd support > + > +--- > + scripts/ip6tables-flush | 13 +++++++++++++ > + scripts/iptables-flush | 13 +++++++++++++ > + systemd/system/ip6tables.service | 14 ++++++++++++++ > + systemd/system/iptables.service | 14 ++++++++++++++ > + 4 files changed, 54 insertions(+) > + create mode 100755 scripts/ip6tables-flush > + create mode 100755 scripts/iptables-flush > + create mode 100755 systemd/system/ip6tables.service > + create mode 100755 systemd/system/iptables.service > + > +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush > +new file mode 100755 > +index 000000000000..95086b0470d3 > +--- /dev/null > ++++ b/scripts/ip6tables-flush > +@@ -0,0 +1,13 @@ > ++#!/bin/sh > ++ip6tables -F > ++ip6tables -X > ++ip6tables -Z > ++for table in $(</proc/net/ip6_tables_names) What happens if there is no ipv6 iptables support in the kernel? Maybe catch that with an error message? > ++do > ++ ip6tables -t $table -F > ++ ip6tables -t $table -X > ++ ip6tables -t $table -Z > ++done > ++ip6tables -P INPUT ACCEPT > ++ip6tables -P OUTPUT ACCEPT > ++ip6tables -P FORWARD ACCEPT Best regards Uwe -- Pengutronix e.K. | Uwe Kleine-König | Industrial Linux Solutions | http://www.pengutronix.de/ | _______________________________________________ ptxdist mailing list [email protected]
