Supports ipv4 and ipv6 and both options can be selected in menuconfig by IPTABLES_IPV6_SYSTEMD_UNIT and/or IPTABLES_IPV4_SYSTEMD_UNIT
If you select IPTABLES_IPV4_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from file: /etc/iptables/rules.v4 If you select IPTABLES_IPV6_SYSTEMD_UNIT a systemd unit is started on multiuser.target that set the iptable rules from the file: /etc/iptables/rules.v6 The Package provides empty files. If you want to add custom rules, you have to provide your own files. The rule files can be generated with the utils iptables-save ip6tables-save from the iptables package. Example: Generating a rule file, that drops port 5000 on interface eth0 for ipv4 1.) iptables -A INPUT -i eth0 -p TCP --dport 5000 -j DROP 2.) iptables-save > /etc/iptables/rules.v4 The basic idea was taken from https://github.com/gronke/systemd-iptables written by Stefan Grönke <[email protected]> in 2015. Signed-off-by: Gavin Schenk <[email protected]> --- projectroot/etc/iptables/rules.v4 | 0 projectroot/etc/iptables/rules.v6 | 0 projectroot/lib/systemd/system/ip6tables.service | 14 ++++++++++++++ projectroot/lib/systemd/system/iptables.service | 14 ++++++++++++++ projectroot/usr/sbin/ip6tables-flush | 19 +++++++++++++++++++ projectroot/usr/sbin/iptables-flush | 19 +++++++++++++++++++ rules/iptables.in | 10 ++++++++++ rules/iptables.make | 17 +++++++++++++++++ 8 files changed, 93 insertions(+) create mode 100644 projectroot/etc/iptables/rules.v4 create mode 100644 projectroot/etc/iptables/rules.v6 create mode 100644 projectroot/lib/systemd/system/ip6tables.service create mode 100644 projectroot/lib/systemd/system/iptables.service create mode 100755 projectroot/usr/sbin/ip6tables-flush create mode 100755 projectroot/usr/sbin/iptables-flush diff --git a/projectroot/etc/iptables/rules.v4 b/projectroot/etc/iptables/rules.v4 new file mode 100644 index 0000000..e69de29 diff --git a/projectroot/etc/iptables/rules.v6 b/projectroot/etc/iptables/rules.v6 new file mode 100644 index 0000000..e69de29 diff --git a/projectroot/lib/systemd/system/ip6tables.service b/projectroot/lib/systemd/system/ip6tables.service new file mode 100644 index 0000000..e842cc1 --- /dev/null +++ b/projectroot/lib/systemd/system/ip6tables.service @@ -0,0 +1,14 @@ +[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +After=systemd-sysctl.service +Before=sysinit.target +ConditionFileNotEmpty=/etc/iptables/rules.v6 +[Service] +Type=oneshot +ExecStart=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6 +ExecReload=/usr/sbin/ip6tables-restore /etc/iptables/rules.v6 +ExecStop=/usr/sbin/iptables/ip6tables-flush +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target diff --git a/projectroot/lib/systemd/system/iptables.service b/projectroot/lib/systemd/system/iptables.service new file mode 100644 index 0000000..fa4a8b3 --- /dev/null +++ b/projectroot/lib/systemd/system/iptables.service @@ -0,0 +1,14 @@ +[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +After=systemd-sysctl.service +Before=sysinit.target +ConditionFileNotEmpty=/etc/iptables/rules.v4 +[Service] +Type=oneshot +ExecStart=/usr/sbin/iptables-restore /etc/iptables/rules.v4 +ExecReload=/usr/sbin/iptables-restore /etc/iptables/rules.v4 +ExecStop=/usr/sbin/iptables-flush +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target diff --git a/projectroot/usr/sbin/ip6tables-flush b/projectroot/usr/sbin/ip6tables-flush new file mode 100755 index 0000000..cf6d22b --- /dev/null +++ b/projectroot/usr/sbin/ip6tables-flush @@ -0,0 +1,19 @@ +#!/bin/sh + +if ! ip6tables --list >/dev/null 2>&1; then + echo "ipv6 filtering is not supported by the running kernel." + exit 3 +fi + +ip6tables -F +ip6tables -X +ip6tables -Z +for table in $(</proc/net/ip6_tables_names) +do + ip6tables -t $table -F + ip6tables -t $table -X + ip6tables -t $table -Z +done +ip6tables -P INPUT ACCEPT +ip6tables -P OUTPUT ACCEPT +ip6tables -P FORWARD ACCEPT diff --git a/projectroot/usr/sbin/iptables-flush b/projectroot/usr/sbin/iptables-flush new file mode 100755 index 0000000..a6e056f --- /dev/null +++ b/projectroot/usr/sbin/iptables-flush @@ -0,0 +1,19 @@ +#!/bin/sh + +if ! iptables --list >/dev/null 2>&1; then + echo "ipv4 filtering is not supported by the running kernel." + exit 3 +fi + +iptables -F +iptables -X +iptables -Z +for table in $(</proc/net/ip_tables_names) +do + iptables -t $table -F + iptables -t $table -X + iptables -t $table -Z +done +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT diff --git a/rules/iptables.in b/rules/iptables.in index e6f3699..8354060 100644 --- a/rules/iptables.in +++ b/rules/iptables.in @@ -25,6 +25,16 @@ config IPTABLES_IPV4 bool prompt "IPv4 support" +config IPTABLES_IPV6_SYSTEMD_UNIT + bool + prompt "Activate IPv6 systemd service unit" + select IPTABLES_IPV6 + +config IPTABLES_IPV4_SYSTEMD_UNIT + bool + prompt "Activate IPv4 systemd service unit" + select IPTABLES_IPV4 + config IPTABLES_LIBIPQ bool prompt "Enable libipq" diff --git a/rules/iptables.make b/rules/iptables.make index 8a1ea66..3dff774 100644 --- a/rules/iptables.make +++ b/rules/iptables.make @@ -126,6 +126,23 @@ ifdef PTXCONF_IPTABLES_IPV4 @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-restore) @$(call install_link, iptables, xtables-multi, /usr/sbin/iptables-save) endif + +ifdef PTXCONF_IPTABLES_IPV6_SYSTEMD_UNIT +# # IPv6 systemd service unit part + @$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v6) + @$(call install_alternative, iptables, 0, 0, 0755, /usr/sbin/ip6tables-flush) + @$(call install_alternative, iptables, 0, 0, 0644, /lib/systemd/system/ip6tables.service) + @$(call install_link, iptables, ../ip6tables.service, /lib/systemd/system/multi-user.target.wants/ip6tables.service) +endif + +ifdef PTXCONF_IPTABLES_IPV4_SYSTEMD_UNIT +# # IPv4 systemd service unit part + @$(call install_alternative, iptables, 0, 0, 0644, /etc/iptables/rules.v4) + @$(call install_alternative, iptables, 0, 0, 0755, /usr/sbin/iptables-flush) + @$(call install_alternative, iptables, 0, 0, 0644, /lib/systemd/system/iptables.service) + @$(call install_link, iptables, ../iptables.service, /lib/systemd/system/multi-user.target.wants/iptables.service) +endif + endif ifdef PTXCONF_IPTABLES_INSTALL_IPTABLES_APPLY -- 1.9.1 _______________________________________________ ptxdist mailing list [email protected]
