#1082383 apf-firewall: Stopping/Restarting APF does not flush old rules

Package:
apf-firewall
Source:
apf-firewall
Submitter:
Emil
Date:
2024-09-20 14:21:02 UTC
Severity:
normal
#1082383#5
Date:
2024-09-20 13:38:08 UTC
From:
To:
Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

This is a known bug, and it leads to total system instability: https://github.com/rfxn/advanced-policy-firewall/issues/48

   * What led up to the situation?

I deployed (apt install apf-firewall) apf-firewall to multiple servers and after changing the configuration, I found the firewall did not have my updates.
Update IG__TCP_CPORTS and remove a port.  Restart apf (apf -r, or apf -f then apf -s, service restart apf-firewall, systemctl restart apf-firewall) and old rules are are still in IP tables.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

I can flush manually as per the github issue: iptables -F, but that broke updates to apf via ansible.  Modified the /usr/sbin/apf script to include iptables -F - this broke ansible.

   * What was the outcome of this action?
iptables shows that rules were flushed, but the chains still exist.  The default policy is reset.

Separate issue: ansible's session is shut down - causing ansible to hang waiting for a response.

   * What outcome did you expect instead?
iptables should drop rules, chains, and reset the default policies

*** End of the template - remove these template lines ***