Red Hat Bugzilla – Bug 1459673
iptables init script doesn't support /etc/sysctl.d/
Last modified: 2018-06-19 01:09:05 EDT
Description of problem: The init script for iptables /etc/init.d/iptables doesn't support /etc/sysctl.d . load_sysctl() { # load matched sysctl values if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then echo -n $"Loading sysctl settings: " ret=0 for item in $IPTABLES_SYSCTL_LOAD_LIST; do fgrep $item /etc/sysctl.conf | sysctl -p - >/dev/null <========= let ret+=$?; done [ $ret -eq 0 ] && success || failure echo fi return $ret } That means that if you edit a kernel parameter related to iptables via /etc/sysctl.d/foo.conf , this won't be applied on iptables restart. Version-Release number of selected component (if applicable): kernel 2.6.32-696.3.1.el6.x86_64 iptables-1.4.7-16.el6.x86_64 How reproducible: 100% Steps to Reproduce: 1. edit parameter net.nf_conntrack_max via /etc/sysctl.d/iptables.conf 2. restart iptables 3. verify if /proc/sys/net/nf_conntrack_max has been modified Actual results: never updated Expected results: always updated
I've forgot this in the bugzilla's description: initscripts-9.03.58-1.el6_9.1.x86_64
The mentioned code is inside a initscript provided by the iputils package.
(In reply to Lukáš Nykrýn from comment #4) > The mentioned code is inside a initscript provided by the iputils package. I think it's provided by iptables package.
This patch work for us: --- iptables.old 2017-06-08 13:18:26.680973312 +0200 +++ iptables 2017-06-08 13:18:39.896022411 +0200 @@ -187,7 +187,7 @@ echo -n $"Loading sysctl settings: " ret=0 for item in $IPTABLES_SYSCTL_LOAD_LIST; do - fgrep $item /etc/sysctl.conf | sysctl -p - >/dev/null + fgrep -hs $item /etc/sysctl.conf /etc/sysctl.d/*.conf | sysctl -p - >/dev/null let ret+=$?; done [ $ret -eq 0 ] && success || failure The same code exists in rhel7, iptables-services package, /usr/libexec/iptables/iptables.init file.
(In reply to Carlos Peón from comment #5) > (In reply to Lukáš Nykrýn from comment #4) > > The mentioned code is inside a initscript provided by the iputils package. > > I think it's provided by iptables package. I confirm that: $ rpm -qf /etc/init.d/iptables iptables-1.4.7-16.el6.x86_64
Already fixed in RHEL7 via bz#1402021. Same solution applies here with one exception: RHEL6 doesn't ship a symlink from /etc/sysctl.d/99-sysctl.conf to /etc/sysctl.conf, so the grep command needs to explicitly search /etc/sysctl.conf as well.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1859