[Bug 1949643] Re: iptables-persistent unconditionally drops existing iptables rules

[Mauricio Faria de Oliveira]

** Description changed:

  [Impact]
  
  The iptables-persistent plugins/{15-ip4tables,25-ip6tables}
  use ip[6]tables-restore without --noflush unconditionally.
  
  This doesn't play along well with ufw, which starts before
  netfilter-persistent typically, and gets its rules flushed.
  
  This makes `ufw status` return that ufw is disabled, which
  is misleading, as `ufw.service` is enabled and ufw actually
  loaded all its rules correctly (but they were flushed later.)
  
  Some images ship iptables-persistent rules, thus are subject
  to this issue if ufw is used.
  
  [Workaround]
  
  Disable the netfilter-persistent.service unit, after rules
  have been migrated to ufw.
  
  [Fix]
  
+ Add options IP[6]TABLES_RESTORE_NOFLUSH (disabled by default)
+ to `/etc/default/netfilter-persistent` to allow not flushing
+ existing ip[6]tables rules.
+ 
  Proposed in Debian bug #998416 [1], Salsa Merge Request [2].
  
  [Test Steps]
  
- See the Debian bug.
+ See commment #14 (based on the Debian bug.)
+ 
+ [Regression Potential]
+ 
+ Regressions would manifest when netfilter-persistent.service
+ starts/loads rules, probably in the form  of failures to run
+ ip[6]tables-restore or incorrectly (not) flushing rules.
+ 
+ Note: there is _no_ behavior change is by default, so users
+ have to opt-in, which should reduce the chances/numbers of
+ potential regressions.
+ 
+ [Links]
  
  [1] https://bugs.debian.org/998416
  [2] https://salsa.debian.org/debian/iptables-persistent/-/merge_requests/3

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1949643

Title:
  iptables-persistent unconditionally drops existing iptables rules

Status in iptables-persistent package in Ubuntu:
  Fix Released
Status in iptables-persistent source package in Bionic:
  In Progress
Status in iptables-persistent source package in Focal:
  In Progress
Status in iptables-persistent source package in Hirsute:
  In Progress
Status in iptables-persistent source package in Impish:
  In Progress
Status in iptables-persistent source package in Jammy:
  Fix Released
Status in iptables-persistent package in Debian:
  Fix Released

Bug description:
  [Impact]

  The iptables-persistent plugins/{15-ip4tables,25-ip6tables}
  use ip[6]tables-restore without --noflush unconditionally.

  This doesn't play along well with ufw, which starts before
  netfilter-persistent typically, and gets its rules flushed.

  This makes `ufw status` return that ufw is disabled, which
  is misleading, as `ufw.service` is enabled and ufw actually
  loaded all its rules correctly (but they were flushed later.)

  Some images ship iptables-persistent rules, thus are subject
  to this issue if ufw is used.

  [Workaround]

  Disable the netfilter-persistent.service unit, after rules
  have been migrated to ufw.

  [Fix]

  Add options IP[6]TABLES_RESTORE_NOFLUSH (disabled by default)
  to `/etc/default/netfilter-persistent` to allow not flushing
  existing ip[6]tables rules.

  Proposed in Debian bug #998416 [1], Salsa Merge Request [2].

  [Test Steps]

  See commment #14 (based on the Debian bug.)

  [Regression Potential]

  Regressions would manifest when netfilter-persistent.service
  starts/loads rules, probably in the form  of failures to run
  ip[6]tables-restore or incorrectly (not) flushing rules.

  Note: there is _no_ behavior change is by default, so users
  have to opt-in, which should reduce the chances/numbers of
  potential regressions.

  [Links]

  [1] https://bugs.debian.org/998416
  [2] https://salsa.debian.org/debian/iptables-persistent/-/merge_requests/3

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/iptables-persistent/+bug/1949643/+subscriptions