[Bug 1949643] Re: iptables-persistent unconditionally drops existing iptables rules
Mauricio Faria de Oliveira
1949643 at bugs.launchpad.net
Tue Dec 14 21:44:12 UTC 2021
Test Steps from Debian bug, for reference.
- 1. Configure rules files:
cat <<EOF4 >/etc/iptables/rules.v4
# Generated by iptables-save v1.8.7 on Wed Nov 3 20:43:56 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -s 1.0.0.1/32 -p icmp -j DROP
COMMIT
# Completed on Wed Nov 3 20:43:56 2021
EOF4
cat <<EOF6 >/etc/iptables/rules.v6
# Generated by ip6tables-save v1.8.7 on Wed Nov 3 20:43:56 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -s 2606:4700:4700::1001/128 -p icmp -j DROP
COMMIT
# Completed on Wed Nov 3 20:43:56 2021
EOF6
- 2. Flush existing rules:
iptables -F
ip6tables -F
- 3. Add rules for 1.1.1.1:
iptables -A INPUT -p icmp -s 1.1.1.1 -j DROP
ip6tables -A INPUT -p icmp -s 2606:4700:4700::1111 -j DROP
- 4. Check rules for 1.1.1.1 are in:
iptables -nL | grep -e 1.1.1.1 -e 1.0.0.1
ip6tables -nL | grep -e 2606:4700:4700::1111 -e 2606:4700:4700::1001
- 5. Start iptables-persistent scripts:
netfilter-persistent start
Default behavior:
- 6. Check rules for 1.0.0.1 are in (rules for 1.1.1.1 are gone)
iptables -nL | grep -e 1.1.1.1 -e 1.0.0.1
ip6tables -nL | grep -e 2606:4700:4700::1111 -e 2606:4700:4700::1001
Optional behavior:
- 7. Enable the new options:
sed -i '/RESTORE_NOFLUSH/ s/^# //' /etc/default/netfilter-persistent
- 8. Repeat steps 2-5
- 9. Check rules for 1.0.0.1 _and_ 1.1.1.1 are in (rules for 1.1.1.1 are
kept)
iptables -nL | grep -e 1.1.1.1 -e 1.0.0.1
ip6tables -nL | grep -e 2606:4700:4700::1111 -e 2606:4700:4700::1001
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1949643
Title:
iptables-persistent unconditionally drops existing iptables rules
Status in iptables-persistent package in Ubuntu:
Fix Released
Status in iptables-persistent source package in Bionic:
In Progress
Status in iptables-persistent source package in Focal:
In Progress
Status in iptables-persistent source package in Hirsute:
In Progress
Status in iptables-persistent source package in Impish:
In Progress
Status in iptables-persistent source package in Jammy:
Fix Released
Status in iptables-persistent package in Debian:
Fix Released
Bug description:
[Impact]
The iptables-persistent plugins/{15-ip4tables,25-ip6tables}
use ip[6]tables-restore without --noflush unconditionally.
This doesn't play along well with ufw, which starts before
netfilter-persistent typically, and gets its rules flushed.
This makes `ufw status` return that ufw is disabled, which
is misleading, as `ufw.service` is enabled and ufw actually
loaded all its rules correctly (but they were flushed later.)
Some images ship iptables-persistent rules, thus are subject
to this issue if ufw is used.
[Workaround]
Disable the netfilter-persistent.service unit, after rules
have been migrated to ufw.
[Fix]
Proposed in Debian bug #998416 [1], Salsa Merge Request [2].
[Test Steps]
See the Debian bug.
[1] https://bugs.debian.org/998416
[2] https://salsa.debian.org/debian/iptables-persistent/-/merge_requests/3
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/iptables-persistent/+bug/1949643/+subscriptions
More information about the Ubuntu-sponsors
mailing list