0

[My Config] Ubuntu 18.04 - digitalocean droplet/server

[Background] I presume from my research that since 18.04 /etc/network/intefaces has been deprecated and something called netplan was introduced. Desktops get NetworkManager while server-Netplan hands control over to systemd-networkd.

[Problem] Getting a script to run on shutdown/restart. I was planning on using pre-up/post-down in /etc/network/interfaces but this does not work for me due to the reasons stated above.

Specifically the script I want to run has to do with saving and restoring iptables at shutdown and restart.

[iptables-persistent] Please do not ask me to install iptables-persistent, because even in that case, I would still have to save and restore iptables to a separate file, like a buffer. If iptables-persistent could somehow save its file in a different location and load that file on restart, I would consider it.

Any ideas?

[I TRIED]

  1. I created a executable file in /etc/NetworkManager/dispatcher.d/01firewall No result. Is this because as stated above NetworkManager is not used in server installs?

  2. I created a service in /lib/systemd/system/ with :

    [Unit]
    Description=ipres
    
    [Service]
    ExecStart=/bin/sh -c '/sbin/iptables-save -c > /etc/blah/firewall/up.save'
    ExecStop=/bin/sh -c '/sbin/iptables-save -c > /etc/blah/firewall/down.save'
    
    [Install]
    WantedBy=multi-user.target
    

    Partial success since the files are created but are empty (is it because it is too late/early for iptables-save to function?)

2 Answers 2

2

In the end I used this service definition in file /etc/systemd/system/ipres.service:

[Unit]
  Description=ipres
  Wants=network-online.target
  After=network.target auditd.service
  ConditionPathExists=/etc/mypath

[Service]
  Type=oneshot
  RemainAfterExit=yes
  ExecStart=/usr/local/bin/my.program load
  ExecStop=/usr/local/bin/my.program save

[Install]
  WantedBy=basic.target

and used my.program /usr/local/bin/my.program (chroot rwx) like so:

#!/bin/sh

    case $1 in
    load)
        #Do some stuff
    ;;
    save)
        #Do some stuff
    ;;
    *)
        echo "Invalid action '$1'"
    ;;
    esac

Don't forget to start and enable your service.

systemctl enable ipres.service && systemctl start ipres.service

Works perfectly for me.

1

Does the command work manually on your server and did you enable the service by using:

systemctl enable < your service name >.service

I have tried your servicefile on ubuntu 16.04 and 18.04 with default installation and everything seems to work ;)

5
  • The command works just fine when run manually. However... I get a 0KB file on mine when I reboot the vps.
    – conanDrum
    Jun 25, 2019 at 11:39
  • Both on ExecStart and ExecStop? Jun 25, 2019 at 11:46
  • No, only when I boot up. So it must have been on load. it is all fixed now with the setup I posted in my answer. did you try rebooting? what do u get?
    – conanDrum
    Jun 25, 2019 at 11:54
  • After a reboot I end up with both files with down: # Generated by iptables-save v1.6.0 on Tue Jun 25 12:29:32 2019 and up: # Generated by iptables-save v1.6.0 on Tue Jun 25 12:27:42 2019 Jun 25, 2019 at 12:13
  • That's strange. when I rebooted I used to get empty files.
    – conanDrum
    Jun 27, 2019 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .