On Thu, Apr 07, 2016 at 12:10:04PM +0200, Gavin Schenk wrote: > Supports ipv4 and ipv6 and both options can be selected in menuconfig > IPTABLES_IPV6_SYSTEMD_UNIT and IPTABLES_IPV4_SYSTEMD_UNIT > > If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on > multiuser.target that set the iptable rules from file /etc/iptables/rules.v4. > If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on > multiuser.target that set the iptable rules from the file > /etc/iptables/rules.v6. > You have to provide this files. Both files can easily be generated with the > utils iptables-save ip6tables-save from the iptables package. > > e.g: Generating a rulefile, that drops port 5000 on interface eth0 ipv4 > 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP > 2.) iptables-save > /etc/iptables/rules.v4 > > The basic idea was taken from https://github.com/gronke/systemd-iptables > written by Stefan Grönke in 2015. > --- > .../0001-Added-files-for-systemd-support.patch | 115 > +++++++++++++++++++++ > patches/iptables-1.4.21/series | 4 + > rules/iptables.in | 10 ++ > rules/iptables.make | 17 +++ > 4 files changed, 146 insertions(+) > create mode 100644 > patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > create mode 100644 patches/iptables-1.4.21/series > > diff --git > a/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > new file mode 100644 > index 0000000..e98a788 > --- /dev/null > +++ b/patches/iptables-1.4.21/0001-Added-files-for-systemd-support.patch > @@ -0,0 +1,115 @@ > +From: Gavin Schenk <[email protected]> > +Date: Wed, 6 Apr 2016 10:19:52 +0200 > +Subject: [PATCH] Added files for systemd support > + > +--- > + etc/iptables/rules.v4 | 0 > + etc/iptables/rules.v6 | 0 > + scripts/ip6tables-flush | 19 +++++++++++++++++++ > + scripts/iptables-flush | 19 +++++++++++++++++++ > + systemd/system/ip6tables.service | 14 ++++++++++++++ > + systemd/system/iptables.service | 14 ++++++++++++++
Please put these files into projectroot/ instead and use install_alternative for all of them. Michael > + 6 files changed, 66 insertions(+) > + create mode 100644 etc/iptables/rules.v4 > + create mode 100644 etc/iptables/rules.v6 > + create mode 100755 scripts/ip6tables-flush > + create mode 100755 scripts/iptables-flush > + create mode 100755 systemd/system/ip6tables.service > + create mode 100755 systemd/system/iptables.service > + > +diff --git a/etc/iptables/rules.v4 b/etc/iptables/rules.v4 > +new file mode 100644 > +index 000000000000..e69de29bb2d1 > +diff --git a/etc/iptables/rules.v6 b/etc/iptables/rules.v6 > +new file mode 100644 > +index 000000000000..e69de29bb2d1 > +diff --git a/scripts/ip6tables-flush b/scripts/ip6tables-flush > +new file mode 100755 > +index 000000000000..cf6d22bb2923 > +--- /dev/null > ++++ b/scripts/ip6tables-flush > +@@ -0,0 +1,19 @@ > ++#!/bin/sh > ++ > ++if ! ip6tables --list >/dev/null 2>&1; then > ++ echo "ipv6 filtering is not supported by the running kernel." > ++ exit 3 > ++fi > ++ > ++ip6tables -F > ++ip6tables -X > ++ip6tables -Z > ++for table in $(</proc/net/ip6_tables_names) > ++do > ++ ip6tables -t $table -F > ++ ip6tables -t $table -X > ++ ip6tables -t $table -Z > ++done > ++ip6tables -P INPUT ACCEPT > ++ip6tables -P OUTPUT ACCEPT > ++ip6tables -P FORWARD ACCEPT > +diff --git a/scripts/iptables-flush b/scripts/iptables-flush > +new file mode 100755 > +index 000000000000..a6e056f31a75 > +--- /dev/null > ++++ b/scripts/iptables-flush > +@@ -0,0 +1,19 @@ > ++#!/bin/sh > ++ > ++if ! iptables --list >/dev/null 2>&1; then > ++ echo "ipv4 filtering is not supported by the running kernel." > ++ exit 3 > ++fi > ++ > ++iptables -F > ++iptables -X > ++iptables -Z > ++for table in $(</proc/net/ip_tables_names) > ++do > ++ iptables -t $table -F > ++ iptables -t $table -X > ++ iptables -t $table -Z > ++done > ++iptables -P INPUT ACCEPT > ++iptables -P FORWARD ACCEPT > ++iptables -P OUTPUT ACCEPT > +diff --git a/systemd/system/ip6tables.service > b/systemd/system/ip6tables.service > +new file mode 100755 > +index 000000000000..e842cc1973a1 > +--- /dev/null > ++++ b/systemd/system/ip6tables.service > +@@ -0,0 +1,14 @@ > ++[Unit] > ++Description=Packet Filtering Framework > ++DefaultDependencies=no > ++After=systemd-sysctl.service > ++Before=sysinit.target > ++ConditionFileNotEmpty=/etc/iptables/rules.v6 > ++[Service] > ++Type=oneshot > ++ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6 > ++ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6 > ++ExecStop=/usr/sbin/iptables/ip6tables-flush > ++RemainAfterExit=yes > ++[Install] > ++WantedBy=multi-user.target > +diff --git a/systemd/system/iptables.service > b/systemd/system/iptables.service > +new file mode 100755 > +index 000000000000..fa4a8b367ca0 > +--- /dev/null > ++++ b/systemd/system/iptables.service > +@@ -0,0 +1,14 @@ > ++[Unit] > ++Description=Packet Filtering Framework > ++DefaultDependencies=no > ++After=systemd-sysctl.service > ++Before=sysinit.target > ++ConditionFileNotEmpty=/etc/iptables/rules.v4 > ++[Service] > ++Type=oneshot > ++ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4 > ++ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4 > ++ExecStop=/usr/sbin/iptables-flush > ++RemainAfterExit=yes > ++[Install] > ++WantedBy=multi-user.target > diff --git a/patches/iptables-1.4.21/series b/patches/iptables-1.4.21/series > new file mode 100644 > index 0000000..b8f388f > --- /dev/null > +++ b/patches/iptables-1.4.21/series > @@ -0,0 +1,4 @@ > +# generated by git-ptx-patches > +#tag:base --start-number 1 > +0001-Added-files-for-systemd-support.patch > +# 366b7fd90bb4fe7e229f0ba777703fb5 - git-ptx-patches magic > diff --git a/rules/iptables.in b/rules/iptables.in > index e6f3699..8354060 100644 > --- a/rules/iptables.in > +++ b/rules/iptables.in > @@ -25,6 +25,16 @@ config IPTABLES_IPV4 > bool > prompt "IPv4 support" > > +config IPTABLES_IPV6_SYSTEMD_UNIT > + bool > + prompt "Activate IPv6 systemd service unit" > + select IPTABLES_IPV6 > + > +config IPTABLES_IPV4_SYSTEMD_UNIT > + bool > + prompt "Activate IPv4 systemd service unit" > + select IPTABLES_IPV4 > + > config IPTABLES_LIBIPQ > bool > prompt "Enable libipq" > diff --git a/rules/iptables.make b/rules/iptables.make > index 8a1ea66..12d3867 100644 > --- a/rules/iptables.make > +++ b/rules/iptables.make > @@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4 > @$(call install_link, iptables, xtables-multi, > /usr/sbin/iptables-restore) > @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save) > endif > + > +ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT > +# # IPv6 systemd service unit part > + @$(call install_copy, iptables, 0, 0, 0755, > $(IPTABLES_DIR)/scripts/ip6tables-flush, /usr/sbin/ip6tables-flush) > + @$(call install_copy, iptables, 0, 0, 0644, > $(IPTABLES_DIR)/systemd/system/ip6tables.service, > /lib/systemd/system/ip6tables.service) > + @$(call install_link, iptables, ../ip6tables.service, > /lib/systemd/system/multi-user.target.wants/ip6tables.service) > + @$(call install_alternative, iptables, 0, 0, 0644, > /etc/iptables/rules.v6) > +endif > + > +ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT > +# # IPv4 systemd service unit part > + @$(call install_copy, iptables, 0, 0, 0755, > $(IPTABLES_DIR)/scripts/iptables-flush, /usr/sbin/iptables-flush) > + @$(call install_copy, iptables, 0, 0, 0644, > $(IPTABLES_DIR)/systemd/system/iptables.service, > /lib/systemd/system/iptables.service) > + @$(call install_link, iptables, ../iptables.service, > /lib/systemd/system/multi-user.target.wants/iptables.service) > + @$(call install_alternative, iptables, 0, 0, 0644, > /etc/iptables/rules.v4) > +endif > + > endif > > ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY > -- > 1.9.1 > > > _______________________________________________ > ptxdist mailing list > [email protected] -- Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list [email protected]
