Hi,
> > If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on
> > multiuser.target that set the iptable rules from file
> > /etc/iptables/rules.v4.
> > If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on
> > multiuser.target that set the iptable rules from the file
> > /etc/iptables/rules.v6.
>
> would it make sense to add a call to install_alternative for the rule files?
Yes, but in this case i have to provide an empty default file.
I have testet ConditionFileNotEmpty with an empty file and it works!
Loaded: loaded (/lib/systemd/system/iptables.service; disabled; vendor preset:
enabled)
Active: inactive (dead)
Condition: start condition failed at Thu 2016-04-07 11:26:45 CEST; 3min 20s ago
ConditionFileNotEmpty=/etc/iptables/rules.v4 was not met
I will add empty files rules.v4 and rules.v6 to the package.
> > +---
> > + scripts/ip6tables-flush | 13 +++++++++++++
> > + scripts/iptables-flush | 13 +++++++++++++
> > + systemd/system/ip6tables.service | 14 ++++++++++++++
> > +systemd/system/iptables.service | 14 ++++++++++++++
> > + 4 files changed, 54 insertions(+)
> > + create mode 100755 scripts/ip6tables-flush create mode 100755
> > +scripts/iptables-flush create mode 100755
> > +systemd/system/ip6tables.service create mode 100755
> > +systemd/system/iptables.service
> > +
> > +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush new
> > +file mode 100755 index 000000000000..95086b0470d3
> > +--- /dev/null
> > ++++ b/scripts/ip6tables-flush
> > +@@ -0,0 +1,13 @@
> > ++#!/bin/sh
> > ++ip6tables -F
> > ++ip6tables -X
> > ++ip6tables -Z
> > ++for table in $(</proc/net/ip6_tables_names)
>
> What happens if there is no ipv6 iptables support in the kernel? Maybe catch
> that with an error message?
>
This is what happens on both ipv4 and ipv6:
iptables-flush
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not
exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not
exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not
exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
/usr/sbin/iptables-flush: line 5: /proc/net/ip_tables_names: No such file or
directory
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not
exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not
exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
modprobe: module ip_tables not found in modules.dep
iptables v1.4.21: can't initialize iptables table `filter': Table does not
exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
What is a good way to detect if the kernel supports iptables?
Instead of digging into /proc my idea is to add something like:
iptables --list &> /dev/null
IPTABLES_SUPPORT=$?
If [ $IPTABLES_SUPPORT -gt 0 ]; then
echo "iptables is not supported by your kernel"
exit $IPTABLES_SUPPORT
fi
What you think about this?
Regards
Gavin Schenk
_______________________________________________
ptxdist mailing list
[email protected]
