Start systemd service after network is up

Question

This is the first time that I have to mess around with systemd. I can't find a solution how to manage, that my service starts after the network is up. I try to start knockd.service on startup on my Raspbian system.

After Boot I check if the service is running:

systemctl status knockd

   Loaded: loaded (/lib/systemd/system/knockd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Thu 2019-06-27 14:36:26 CEST; 7min ago
     Docs: man:knockd(1)
  Process: 516 ExecStart=/usr/sbin/knockd $KNOCKD_OPTS (code=exited, status=1/FAILURE)
 Main PID: 516 (code=exited, status=1/FAILURE)

Jun 27 14:36:26 pins2 systemd[1]: Started Port-Knock Daemon.
Jun 27 14:36:26 pins2 knockd[516]: could not get IP address for eth0
Jun 27 14:36:26 pins2 systemd[1]: knockd.service: Main process exited, code=exited, status=1/FAILURE
Jun 27 14:36:26 pins2 systemd[1]: knockd.service: Unit entered failed state.
Jun 27 14:36:26 pins2 systemd[1]: knockd.service: Failed with result 'exit-code'.

I think the Problem is this:

could not get IP address for eth0

After I investigated a lot (like here and there) I found some good hints, but unfortunately it still does not work. My .service file looks like this:

systemctl cat knockd

# /lib/systemd/system/knockd.service
[Unit]
Description=Port-Knock Daemon
Documentation=man:knockd(1)                                                                         
#Requires=network-online.target                                                                     
#Wants=network-online.target                                                                     
After=network-online.target                                                                    

[Service]                                                                                           
EnvironmentFile=-/etc/default/knockd                                                                
ExecStart=/usr/sbin/knockd $KNOCKD_OPTS                                                             
ExecReload=/bin/kill -HUP $MAINPID                                                                  
KillMode=mixed                                                                                      
SuccessExitStatus=0 2 15                                                                            
ProtectSystem=full                                                                                  
CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN                                                     

[Install]                                                                                           
WantedBy=multi-user.target                                                                          
Alias=knockd.service                

I already use After=network-online.target in my Unit section. What else do I have to do, I already tried Requires= and Wants=?

After Boot my system has an IP Address, and starting the Service manually works without any problems. On another network with some faster network I did not have any Problems even without the network-online target.

As you can imagine it is quite essential, that knockd starts reliably, because if not, I am locked out.

If this works reliably, will this also work, if the network cable is connected some time after boot?

BTW, I know that I should not edit the .service file in /lib/systemd/... I just did that to sort out possible override problems. I will fix that after everything is working. Thank you for your help.

Answer 1

You need the Wants= directive since network-online.target is not pulled in the dependency chain by default (see systemd.special(7) manpage).

You also might want to enable ifupdown-wait-online.service (systemctl enable ifupdown-wait-online.service) if you are not using NetworkManager

Answer 2

@Bigon has the right general idea.

The core problem here is that network-online.target isn't normally pulled into the dependency tree for systemd. When systemd processes the After=network-online.target line in your unit it determines that it can ignore it because network-online.target isn't going to happen.

What you need is a unit that pulls network-online.target into the dependency tree at a point when the network is ::drum roll:: online. Many distroes provide such a unit. Network managers also often provide this functionality.

Since I don't know your distro it's difficult for me to know what unit to tell you to enable. And, while switching to networkmanager will likely solve your problem networkmanager will make a lot of other changes to how your system works as well, possibly conflicting with existing configuration.

Answer 3

Simply install network-manager worked fine for me on Rasbian.

Network Manager allows NetworkManager-wait-online.service. Since the interfaces are not ready at startin of knockd, this gives time to the network to bring the interface up.