The officially official Devuan Forum!

You are not logged in.

#1 2019-06-11 20:35:18

d0nzag
Member
Registered: 2019-06-10
Posts: 9  

[Solved] How to load nftables rules at boot?

/etc/modules has all nf_tables* modules loaded
/etc/nftables.conf has no effect

what else could be done / checked ?

Last edited by d0nzag (2019-06-16 03:00:34)

Offline

#2 2019-06-11 21:22:57

ralph.ronnquist
Administrator
From: Clifton Hill, Victoria, AUS
Registered: 2016-11-30
Posts: 468  

Re: [Solved] How to load nftables rules at boot?

initrd ?

Offline

#3 2019-06-12 09:57:52

d0nzag
Member
Registered: 2019-06-10
Posts: 9  

Re: [Solved] How to load nftables rules at boot?

This is too much. Aborting...

Offline

#4 2019-06-12 10:31:10

Head_on_a_Stick
Member
From: London
Registered: 2019-03-24
Posts: 1,142  
Website

Re: [Solved] How to load nftables rules at boot?

Try

# cp /usr/share/doc/nftables/examples/sysvinit/nftables.init /etc/init.d
# update-rc.d nftables defaults

Then reboot.


Black Lives Matter

Offline

#5 2019-06-16 02:59:32

d0nzag
Member
Registered: 2019-06-10
Posts: 9  

Re: [Solved] How to load nftables rules at boot?

The answer is - same way as with https://wiki.debian.org/iptables

Create executable file /etc/network/if-pre-up.d/nftables with the content

 #!/bin/sh
 /sbin/nft -f  /<path_to>/my.nftables.rules

and that's it smile

Offline

#6 2020-04-21 22:07:05

Marjorie
Member
From: Teignmouth, UK
Registered: 2019-06-09
Posts: 90  

Re: [Solved] How to load nftables rules at boot?

I'm setting up a mailserver and I'm trying to use nftables on Beowulf rather than iptables and ufw.as I used to on ASCII.

Head_on_a_Stick wrote:

Try

# cp /usr/share/doc/nftables/examples/sysvinit/nftables.init /etc/init.d
# update-rc.d nftables defaults

Then reboot.

Assuming I want to start nftables as a service (in the same way that systemd imitates). I would have to change this slightly:

$ sudo cp /usr/share/doc/nftables/examples/sysvinit/nftables.init /etc/init.d/nftables
$ sudo chmod +x  /etc/init.d/nftables
$ sudo update-rc.d nftables defaults

When I run

$ sudo service nftables start

and then

$ sudo service nftables status 

there's no output from either and the process is not running.

I looks to me that the problem is that nftables, as supplied, isn't configured to start in any level:

/etc/init.d/nftables starts:

#!/bin/sh
### BEGIN INIT INFO
# Provides:          nftables
# Required-Start:    $local_fs $network $remote_fs $syslog
# Required-Stop:     $local_fs $remote_fs $syslog
# Default-Start:
# Default-Stop:      0 1 2 3 4 5 6
# Short-Description: nftables firewall service
# Description:       nftables firewall system service
### END INIT INFO

# Author: Arturo Borrero Gonzalez <arturo@debian.org>
....

So no start run levels are defined. Should this be amended before running update-rc.d, and should they be the 'standard'?

# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6

It would be nice if the package could be devuanated for Beowulf as it's systemd specific as supplied in Debian.
I note there was some discussion about how to enable running on sysvinit back in 2015 when Arturo decided to only supply nftables.init as an example - but then not document what needed to be done to enable it.

Offline

#7 2020-04-22 12:26:30

Head_on_a_Stick
Member
From: London
Registered: 2019-03-24
Posts: 1,142  
Website

Re: [Solved] How to load nftables rules at boot?

Marjorie wrote:

no start run levels are defined

Good spot, I missed that.

I've just run the sysd2v-0.2.sh script on the systemd nftables.service and it says

# Default-Start:  S
# Default-Stop:   0 6

So try that.

EDIT: perhaps open a bug report for this on the Debian package, the maintainer might correct it.

Last edited by Head_on_a_Stick (2020-04-22 12:27:20)


Black Lives Matter

Offline

#8 2020-04-22 14:34:44

Marjorie
Member
From: Teignmouth, UK
Registered: 2019-06-09
Posts: 90  

Re: [Solved] How to load nftables rules at boot?

Thanks, Head-on-a-stick, that works.

Note for anyone else searching on this topic, having edited the default run level values in /etc/init.d/nftables you have to remove any existing rc.d symlinks before you reset them, so:

$ sudo update-rc.d nftables remove
$ sudo update-rc.d nftables defaults

If you don't do that it wont just overwrite the existing symlinks (you do get a warning).

Also

$ sudo service nftables start
$ sudo service nftables status 

don't provide any output. However I did check that the firewall was working as intended using nmap from a different pc on the network:

$ sudo nmap --top-ports 500 mail
Starting Nmap 7.70 ( https://nmap.org ) at 2020-04-22 15:17 BST
Nmap scan report for mail (192.168.1.xx)
Host is up (0.0054s latency).
Not shown: 493 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
143/tcp open  imap
443/tcp open  https
587/tcp open  submission
993/tcp open  imaps
MAC Address: 2D:70:6B:23:64:91

which are just the ports I had configured to be open.

Last edited by Marjorie (2020-04-22 14:37:07)

Offline

#9 2020-11-11 11:14:45

jdev
Member
Registered: 2020-06-09
Posts: 22  

Re: [Solved] How to load nftables rules at boot?

Marjorie wrote:

Also

$ sudo service nftables start
$ sudo service nftables status 

don't provide any output.

Add INIT_VERBOSE=yes to the definitions of environment variables in /etc/init.d/nftables.

Offline

#10 2020-11-12 13:36:50

Magnus
Member
Registered: 2020-03-14
Posts: 23  

Re: [Solved] How to load nftables rules at boot?

Or add a line in /etc/rc.local /usr/sbin/nft -f /etc/firewall.tables

Offline

#11 2020-11-12 18:03:15

Head_on_a_Stick
Member
From: London
Registered: 2019-03-24
Posts: 1,142  
Website

Re: [Solved] How to load nftables rules at boot?

Magnus wrote:

Or add a line in /etc/rc.local

Anything in /etc/rc.local is run late in the boot process so that would leave the network exposed, albeit very briefly. A proper init script is the best approach.


Black Lives Matter

Offline

Board footer