Bug 1313936 - RFE: systemd unit for nftables
RFE: systemd unit for nftables
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: nftables (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Kevin Fenzi
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-03-02 11:11 EST by Major Hayden
Modified: 2016-04-10 16:10 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-04-10 16:10:48 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Major Hayden 2016-03-02 11:11:35 EST
The nftables package works fine in Fedora 23, but there's no systemd service that I can use to load nftables tables/chains/rules at boot time.  The Arch folks have cobbled together some files to do this:

https://projects.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/nftables

Would it be possible to get something like this into the nftables package?  Thanks!
Comment 1 Kevin Fenzi 2016-03-05 11:34:03 EST
I've no objection, but has anyone asked them to submit those upstream? 

Also with the last release ~6months ago, perhaps it's time to nag them about another one.
Comment 2 Kevin Fenzi 2016-03-21 13:15:32 EDT
Sadly, upstream refuses to add systemd units. ;( 

I'll try and find some time soon to look at the debian and arch and suse ones and see which ones seem the best to base off of.
Comment 3 Kevin Fenzi 2016-03-25 15:22:10 EDT
ok. I have added a unit file to the last rawhide build. Should show up tomorrow. 

Let me know if you see any problems with it.
Comment 4 dac.override 2016-03-26 08:16:26 EDT
Thanks that is inspiring. I was/am using this (for nftables):

[Unit]
Description=nftables
Documentation=man:nftables(8)
Before=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -I /etc/nftables -f /etc/nftables/ipv4
ExecStop=/usr/sbin/nft flush table ip filter
ExecStop=/usr/sbin/nft flush table ip nat
ExecStop=/usr/sbin/nft flush table ip mangle
ExecStop=/usr/sbin/nft delete table ip filter
ExecStop=/usr/sbin/nft delete table ip nat
ExecStop=/usr/sbin/nft delete table ip mangle

[Install]
WantedBy=network.target

And this for nf6tables:

[Unit]
Description=nf6tables
Documentation=man:nftables(8)
After=nftables.service
Before=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -I /etc/nftables -f /etc/nftables/ipv6
ExecStop=/usr/sbin/nft flush table ip6 filter
ExecStop=/usr/sbin/nft flush table ip6 nat
ExecStop=/usr/sbin/nft flush table ip6 mangle
ExecStop=/usr/sbin/nft delete table ip6 filter
ExecStop=/usr/sbin/nft delete table ip6 nat
ExecStop=/usr/sbin/nft delete table ip6 mangle

[Install]
WantedBy=network.target

Yours is much better (of course)

However yours is using /etc/nftables.conf. Does that actually exist?
Comment 5 Kevin Fenzi 2016-03-26 11:51:07 EDT
Oops. I forgot to include it. It can be just empty or have your rules in it. 

I meant to include one with a bunch of comments. Thinking about it, I wonder if it shouldn't be /etc/sysconfig/nftables and /etc/sysconfig/nftables-ipv6 to match the iptables setup. 

I also see I somehow typoed the Install line. ;( 

Will push a fixed package today... sorry about that.
Comment 6 Major Hayden 2016-03-28 09:34:48 EDT
Thanks, Kevin!  The new systemd unit works well!
Comment 7 Kevin Fenzi 2016-04-10 16:10:48 EDT
ok. I fixed the install typo, added a dummy nftables.conf file and moved it over to /etc/sysconfig/nftables.conf. 

Feedback welcome.

Note You need to log in before you can comment on or make changes to this bug.