Bug 1314962

Summary: iptables-services package dependency issue
Product: Red Hat Enterprise Linux 7 Reporter: oakwhiz
Component: iptablesAssignee: Thomas Woerner <twoerner>
Status: CLOSED DUPLICATE QA Contact: qe-baseos-daemons
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.2CC: iptables-maint-list
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-01 10:04:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description oakwhiz 2016-03-05 07:19:04 UTC 
User-Agent:       Mozilla/5.0 (Windows NT 6.3; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0
Build Identifier: 

iptables-services is dependent on policycoreutils.

If policycoreutils is not installed, iptables-services does not function correctly. Rules are not saved automatically or manually, as shown below:

# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables: /usr/libexec/iptables/iptables.init: line 315: restorecon: command not found


However the yum packages do not reflect this dependency and it is possible to install iptables-services without installing policycoreutils. This causes some frustration, since iptables-services loads rules from defaults on boot, which blocks most incoming traffic. It is also difficult to determine the cause of the problem through systemctl status.

Installing policycoreutils fixes the problem.

Reproducible: Always

Steps to Reproduce:
1. Don't install policycoreutils
2. Install iptables-services
3. Notice that iptables and ip6tables are not persistent
4. Notice that rules cannot be saved manually either
5. Install policycoreutils
6. Notice that everything works now
Comment 1 oakwhiz 2016-03-05 07:21:05 UTC 
Bug originally filed against CentOS here:
https://bugs.centos.org/view.php?id=10492
Comment 3 Thomas Woerner 2016-07-01 10:04:11 UTC 

*** This bug has been marked as a duplicate of bug 1246380 ***