Red Hat Bugzilla – Bug 1313936
RFE: systemd unit for nftables
Last modified: 2016-04-10 16:10:48 EDT
The nftables package works fine in Fedora 23, but there's no systemd service that I can use to load nftables tables/chains/rules at boot time. The Arch folks have cobbled together some files to do this:
Would it be possible to get something like this into the nftables package? Thanks!
I've no objection, but has anyone asked them to submit those upstream?
Also with the last release ~6months ago, perhaps it's time to nag them about another one.
Sadly, upstream refuses to add systemd units. ;(
I'll try and find some time soon to look at the debian and arch and suse ones and see which ones seem the best to base off of.
ok. I have added a unit file to the last rawhide build. Should show up tomorrow.
Let me know if you see any problems with it.
Thanks that is inspiring. I was/am using this (for nftables):
ExecStart=/usr/sbin/nft -I /etc/nftables -f /etc/nftables/ipv4
ExecStop=/usr/sbin/nft flush table ip filter
ExecStop=/usr/sbin/nft flush table ip nat
ExecStop=/usr/sbin/nft flush table ip mangle
ExecStop=/usr/sbin/nft delete table ip filter
ExecStop=/usr/sbin/nft delete table ip nat
ExecStop=/usr/sbin/nft delete table ip mangle
And this for nf6tables:
ExecStart=/usr/sbin/nft -I /etc/nftables -f /etc/nftables/ipv6
ExecStop=/usr/sbin/nft flush table ip6 filter
ExecStop=/usr/sbin/nft flush table ip6 nat
ExecStop=/usr/sbin/nft flush table ip6 mangle
ExecStop=/usr/sbin/nft delete table ip6 filter
ExecStop=/usr/sbin/nft delete table ip6 nat
ExecStop=/usr/sbin/nft delete table ip6 mangle
Yours is much better (of course)
However yours is using /etc/nftables.conf. Does that actually exist?
Oops. I forgot to include it. It can be just empty or have your rules in it.
I meant to include one with a bunch of comments. Thinking about it, I wonder if it shouldn't be /etc/sysconfig/nftables and /etc/sysconfig/nftables-ipv6 to match the iptables setup.
I also see I somehow typoed the Install line. ;(
Will push a fixed package today... sorry about that.
Thanks, Kevin! The new systemd unit works well!
ok. I fixed the install typo, added a dummy nftables.conf file and moved it over to /etc/sysconfig/nftables.conf.