Public bug reported: [Impact]
The iptables-persistent plugins/{15-ip4tables,25-ip6tables} use ip[6]tables-restore without --noflush unconditionally. This doesn't play along well with ufw, which starts before netfilter-persistent typically, and gets its rules flushed. This makes `ufw status` return that ufw is disabled, which is misleading, as `ufw.service` is enabled and ufw actually loaded all its rules correctly (but they were flushed later.) Some images ship iptables-persistent rules, thus are subject to this issue if ufw is used. [Workaround] Disable the netfilter-persistent.service unit, after rules have been migrated to ufw. [Fix] Proposed in Debian bug #998416 [1] [Test Steps] See the Debian bug. [1] https://bugs.debian.org/998416 ** Affects: iptables-persistent (Ubuntu) Importance: Medium Assignee: Mauricio Faria de Oliveira (mfo) Status: Confirmed ** Affects: iptables-persistent (Debian) Importance: Unknown Status: Unknown ** Changed in: iptables-persistent (Ubuntu) Status: New => Confirmed ** Changed in: iptables-persistent (Ubuntu) Importance: Undecided => Medium ** Changed in: iptables-persistent (Ubuntu) Assignee: (unassigned) => Mauricio Faria de Oliveira (mfo) ** Bug watch added: Debian Bug tracker #998416 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998416 ** Also affects: iptables-persistent (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998416 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1949643 Title: iptables-persistent unconditionally drops existing iptables rules To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/iptables-persistent/+bug/1949643/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs