2

On one machine, I've prepared a firewall.service systemd service that works fine on that machine running Debian 9.5.

Now I'm setting up another machine, also running Debian 9.5, using the exact same script, but refuses to run at startup and I can't seem to find any indication as to why.

Immediately following startup, here is some output, indicating to me only that systemd never tried starting the service in the first place:

[root@bigbrother ~]# journalctl -u firewall
-- No entries --
[root@bigbrother ~]# systemctl status firewall
● firewall.service - Firewall setup via /etc/iptables.rules
   Loaded: loaded (/etc/systemd/system/firewall.service; enabled; vendor preset: enabled)
   Active: inactive (dead)

The firewall service is in /etc/systemd/system/firewall.service on both machines and looks like this:

[Unit]
Description=Firewall setup via /etc/iptables.rules
After=network.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore /etc/iptables.rules

[Install]
WantedBy=network-online.target

As you can see, it just runs an iptables-restore command, and that's it. I used to run this with /etc/rc.local earlier, but I guess one must keep up with fashion and use systemd for such things (which is fine, when it works).

The service is indeed enabled:

[root@bigbrother ~]# systemctl disable firewall
Removed /etc/systemd/system/network-online.target.wants/firewall.service.
[root@bigbrother ~]# systemctl enable firewall
Created symlink /etc/systemd/system/network-online.target.wants/firewall.service → /etc/systemd/system/firewall.service.

And it works fine when run manually:

[root@bigbrother ~]# systemctl start firewall
[root@bigbrother ~]# systemctl status firewall
● firewall.service - Firewall setup via /etc/iptables.rules
   Loaded: loaded (/etc/systemd/system/firewall.service; disabled; vendor preset: enabled)
   Active: inactive (dead)

Sep 09 17:10:52 bigbrother systemd[1]: Starting Firewall setup via /etc/iptables.rules...
Sep 09 17:10:53 bigbrother systemd[1]: Started Firewall setup via /etc/iptables.rules.

What am I missing?

I've looked around at some similar questions here, but the one that gave me the most promise was actually a typo, so I'm totally lost at the moment. It's the same version of Debian that I'm running on a different server, so I find it hard to believe that this has something to do with the order of the services. Even so, I'll gladly take suggestions on that.

1

Perhaps it is running too early. This document explains how network.target's primary purpose is for ordering things properly at shutdown.

Instead network-pre.target's primary purpose is for usage with firewall services. Services that want to be run before the network is configured should use

Before=network-pre.target 
Wants=network-pre.target

This is what I see in Fedora 24's firewalld.service Unit, for example, which I believe is a front-end to iptables.

2

WantedBy=network-online.target is not part of the dependency chain by default and you shouldn't use it like that.

If you really needs to start that script after the network is up I would suggest you to do:

[Unit]
Description=Firewall setup via /etc/iptables.rules
After=network.target
Before=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore /etc/iptables.rules

[Install]
WantedBy=multi-user.target

https://www.freedesktop.org/software/systemd/man/systemd.special.html#network.target https://www.freedesktop.org/software/systemd/man/systemd.special.html#network-online.target

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.