Supports ipv4 and ipv6 and both options can be selected in menuconfig IPTABLES_IPV6_SYSTEMD_UNIT and IPTABLES_IPV4_SYSTEMD_UNIT
If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from file /etc/iptables/rules.v4. If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from the file /etc/iptables/rules.v6. You have to provide this files. Both files can easily be generated with the utils iptables-save ip6tables-save from the iptables package. e.g: Generating a rulefile, that drops port 5000 on interface eth0 ipv4 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP 2.) iptables-save > /etc/iptables/rules.v4 The basic idea was taken from https://github.com/gronke/systemd-iptables written by Stefan Grönke in 2015. --- .../0001-Added-files-for-systemd-support.patch | 115 +++++++++++++++++++++ patches/iptables-1.4.21/series | 4 + rules/iptables.in | 10 ++ rules/iptables.make | 17 +++ 4 files changed, 146 insertions(+) create mode 100644 patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch create mode 100644 patches/iptables-1.4.21/series diff --git a/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch new file mode 100644 index 0000000..e98a788 --- /dev/null +++ b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch @@ -0,0 +1,115 @@ +From: Gavin Schenk <[email protected]> +Date: Wed, 6 Apr 2016 10:19:52 +0200 +Subject: [PATCH] Added files for systemd support + +--- + etc/iptables/rules.v4 | 0 + etc/iptables/rules.v6 | 0 + scripts/ip6tables-flush | 19 +++++++++++++++++++ + scripts/iptables-flush | 19 +++++++++++++++++++ + systemd/system/ip6tables.service | 14 ++++++++++++++ + systemd/system/iptables.service | 14 ++++++++++++++ + 6 files changed, 66 insertions(+) + create mode 100644 etc/iptables/rules.v4 + create mode 100644 etc/iptables/rules.v6 + create mode 100755 scripts/ip6tables-flush + create mode 100755 scripts/iptables-flush + create mode 100755 systemd/system/ip6tables.service + create mode 100755 systemd/system/iptables.service + +diff --git a/etc/iptables/rules.v4 b/etc/iptables/rules.v4 +new file mode 100644 +index 000000000000..e69de29bb2d1 +diff --git a/etc/iptables/rules.v6 b/etc/iptables/rules.v6 +new file mode 100644 +index 000000000000..e69de29bb2d1 +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush +new file mode 100755 +index 000000000000..cf6d22bb2923 +--- /dev/null ++++ b/scripts/ip6tables-flush +@@ -0,0 +1,19 @@ ++#!/bin/sh ++ ++if ! ip6tables --list >/dev/null 2>&1; then ++ echo "ipv6 filtering is not supported by the running kernel." ++ exit 3 ++fi ++ ++ip6tables -F ++ip6tables -X ++ip6tables -Z ++for table in $(</proc/net/ip6_tables_names) ++do ++ ip6tables -t $table -F ++ ip6tables -t $table -X ++ ip6tables -t $table -Z ++done ++ip6tables -P INPUT ACCEPT ++ip6tables -P OUTPUT ACCEPT ++ip6tables -P FORWARD ACCEPT +diff --git a/scripts/iptables-flush b/scripts/iptables-flush +new file mode 100755 +index 000000000000..a6e056f31a75 +--- /dev/null ++++ b/scripts/iptables-flush +@@ -0,0 +1,19 @@ ++#!/bin/sh ++ ++if ! iptables --list >/dev/null 2>&1; then ++ echo "ipv4 filtering is not supported by the running kernel." ++ exit 3 ++fi ++ ++iptables -F ++iptables -X ++iptables -Z ++for table in $(</proc/net/ip_tables_names) ++do ++ iptables -t $table -F ++ iptables -t $table -X ++ iptables -t $table -Z ++done ++iptables -P INPUT ACCEPT ++iptables -P FORWARD ACCEPT ++iptables -P OUTPUT ACCEPT +diff --git a/systemd/system/ip6tables.service b/systemd/system/ip6tables.service +new file mode 100755 +index 000000000000..e842cc1973a1 +--- /dev/null ++++ b/systemd/system/ip6tables.service +@@ -0,0 +1,14 @@ ++[Unit] ++Description=Packet Filtering Framework ++DefaultDependencies=no ++After=systemd-sysctl.service ++Before=sysinit.target ++ConditionFileNotEmpty=/etc/iptables/rules.v6 ++[Service] ++Type=oneshot ++ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6 ++ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6 ++ExecStop=/usr/sbin/iptables/ip6tables-flush ++RemainAfterExit=yes ++[Install] ++WantedBy=multi-user.target +diff --git a/systemd/system/iptables.service b/systemd/system/iptables.service +new file mode 100755 +index 000000000000..fa4a8b367ca0 +--- /dev/null ++++ b/systemd/system/iptables.service +@@ -0,0 +1,14 @@ ++[Unit] ++Description=Packet Filtering Framework ++DefaultDependencies=no ++After=systemd-sysctl.service ++Before=sysinit.target ++ConditionFileNotEmpty=/etc/iptables/rules.v4 ++[Service] ++Type=oneshot ++ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4 ++ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4 ++ExecStop=/usr/sbin/iptables-flush ++RemainAfterExit=yes ++[Install] ++WantedBy=multi-user.target diff --git a/patches/iptables-1.4.21/series b/patches/iptables-1.4.21/series new file mode 100644 index 0000000..b8f388f --- /dev/null +++ b/patches/iptables-1.4.21/series @@ -0,0 +1,4 @@ +# generated by git-ptx-patches +#tag:base --start-number 1 +0001-Added-files-for-systemd-support.patch +# 366b7fd90bb4fe7e229f0ba777703fb5 - git-ptx-patches magic diff --git a/rules/iptables.in b/rules/iptables.in index e6f3699..8354060 100644 --- a/rules/iptables.in +++ b/rules/iptables.in @@ -25,6 +25,16 @@ config IPTABLES_IPV4 bool prompt "IPv4 support" +config IPTABLES_IPV6_SYSTEMD_UNIT + bool + prompt "Activate IPv6 systemd service unit" + select IPTABLES_IPV6 + +config IPTABLES_IPV4_SYSTEMD_UNIT + bool + prompt "Activate IPv4 systemd service unit" + select IPTABLES_IPV4 + config IPTABLES_LIBIPQ bool prompt "Enable libipq" diff --git a/rules/iptables.make b/rules/iptables.make index 8a1ea66..12d3867 100644 --- a/rules/iptables.make +++ b/rules/iptables.make @@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4 @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-restore) @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save) endif + +ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT +# # IPv6 systemd service unit part + @$(call install_copy, iptables, 0, 0, 0755, $(IPTABLES_DIR)/scripts/ip6tables-flush, /usr/sbin/ip6tables-flush) + @$(call install_copy, iptables, 0, 0, 0644, $(IPTABLES_DIR)/systemd/system/ip6tables.service, /lib/systemd/system/ip6tables.service) + @$(call install_link, iptables, ../ip6tables.service, /lib/systemd/system/multi-user.target.wants/ip6tables.service) + @$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v6) +endif + +ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT +# # IPv4 systemd service unit part + @$(call install_copy, iptables, 0, 0, 0755, $(IPTABLES_DIR)/scripts/iptables-flush, /usr/sbin/iptables-flush) + @$(call install_copy, iptables, 0, 0, 0644, $(IPTABLES_DIR)/systemd/system/iptables.service, /lib/systemd/system/iptables.service) + @$(call install_link, iptables, ../iptables.service, /lib/systemd/system/multi-user.target.wants/iptables.service) + @$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v4) +endif + endif ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY -- 1.9.1 _______________________________________________ ptxdist mailing list [email protected]
