Bug 1317244

Summary: RFE: integrate systemd unit with firewall.target
Product: [Fedora] Fedora Reporter: Jonathan Underwood <jonathan.underwood>
Component: iptablesAssignee: Thomas Woerner <twoerner>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: jpopelka, twoerner
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1317240    
Bug Blocks: 1266512    

Description Jonathan Underwood 2016-03-13 10:00:28 UTC 
Description of problem:
While trying to ensure that iptables dependent components (such as fail2ban) are properly restarted on a iptables restart, and also cater for conflicts with other firewall providing services (firewalld, shorewall...) it was suggested on systemd-devel[1] that there should be a firewall.target, which firewall implementations are PartOf.

Once firewall.target is in place (BZ #1317240),this would involve adding:

1) PartOf=firewall.target to the Unit section
2) WantedBy=firewall.target to the Install section

Ideally we'd like to get this in for F24 and F25, but it may be late in the day for F24.

It would probably be a good idea to also add RefuseManualStart and RefuseManualStop to the service too to ensure that starting and stopping is done via the firewalll target to ensure other dependent components such as fail2ban are correctly (re)started. However, this final step may need changes to the firewalld gui.

[1] https://lists.freedesktop.org/archives/systemd-devel/2016-March/036021.html