Hi,

I just got orphan-sysvinit-scripts pulled in on a few boxes where I happen to have nftables installed but rules are still defined and loaded by iptables, called by a locally-defined init script.

/etc/rcS.d/ contains (among others):
S10iptables-rules
S11networking
S12nftables

Since /etc/nftables.conf is empty (as shipped), this ends up wiping out my rules, and I need to fix that with 'update-rc.d nftables remove'.

Perhaps a NEWS entry should be made for this, or more aggressively, users should be advised to 'update-rc.d nftables defaults' as they see fit, considering they have lived thus far without a distribution-shipped init script.

Another comment: my iptables-rules init script says:

# Required-Start:    $local_fs
# Required-Stop:
# Default-Start:     S
# Default-Stop:

which makes sense to me. The points: load the rules before any network interfaces are brought up, and, why would I ever want the rules to be automatically unloaded during shutdown?

By contrast, the nftables script says:

# Required-Start:    $local_fs $network
# Required-Stop:     $local_fs $network
# Should-Start:     
# Default-Start:     S
# Default-Stop:      0 1 6

Which has stop actions (which actually flush the ruleset) and loads *after* network interfaces are already up.

Thanks,

Gedalya

Hi,

I'm slightly confused by your report, sorry. Historically nftables did
have a sysvinit script (though it was removed from the package in a
previous version).

You installed a version of nftables without a sysvinit script on a
sysvinit system, and made your own sysvinit script for it that you
didn't call /etc/init.d/nftables ?

And you installed your nftables config somewhere that wasn't the
expected location /etc/nftables.conf ?

The init script that used to ship with nftables had the following init info:

# Required-Start:    $local_fs $network $remote_fs $syslog
# Required-Stop:     $local_fs $remote_fs $syslog
# Default-Start:
# Default-Stop:      0 1 2 3 4 5 6
# Short-Description: nftables firewall service
# Description:       nftables firewall system service

Which is not quite the same as the version in orphan-sysvinit-scripts.

Regards,

Matthew

OK, I wasn't keeping track of that. On the three boxes I was just upgrading, there was no nftables init script until now.

iptables. I'm using iptables. Not using nftables. nftables is just installed, so I can play with it, towards migrating to it. Having it installed, while not actively used, didn't pose an issue until now. I have my own iptables-rules init.d script which does iptables-restore < /etc/iptables.conf

The issue is that now the distribution-shipped nftables script wipes out my iptables rules, which are important. I would suspect that iptables being used isn't a rare thing, and using an init script as a means of loading the rules might be common as well, and it would sometimes be done by a locally-defined script. Looking at the changelog now, it seems like the init script was last shipped in the nftables package in 2016? So going through this scenario, of having nftables with no init script, and one popping up now, shouldn't be very unusual?

Just in case this requires explicit clarification:

iptables-restore < /etc/iptables.conf
# now I have a firewall
nft flush ruleset
# now I don't
iptables-restore < /etc/iptables.conf
# now I do
nft -f /etc/nftables.conf
# now I have whatever that is, read: nothing by default

This would have something to do with the fact that iptables uses the nftables backend, I guess?