0

I rely on my specific service to load iptables rules at startup in my debian installation, this service calls

iptables-restore my_rules.v4

ip6tables-restore my_rules.v6

and do some other scripts

however I realized that there's a small delta of time where default rules are applied between the enabling of the interfaces and the applying of the fw rules, this could expose the machine to some risks.

I've enabled the iptables-persistent service but I'm not sure it is loaded before the networking part being started.

What is the best way to load my script before networking is online and available ?

I heard of pre-up in interfaces but I have many interfaces so I'm not sure of what interface be put up first, and using pre-up on all interfaces would cause the script being run too many times instead of just one.

5
  • Can you configure the interfaces but not enable them, restore the iptables rules, and then up each interface? Putting in a systemd service file to run after the iptables service should not be hard and bringing up each interface is fast.
    – doneal24
    Nov 14, 2023 at 18:27
  • 3
    iptables/nftables both allow to load firewall rules before network interfaces are enabled. Change the order and you're good to go. Nov 14, 2023 at 18:44
  • @doneal24 what do you mean for configure but not start them? by creating the file inside /etc/networking/interfaces? But how tell debian to not start them automatically during the boot process? Nov 15, 2023 at 11:36
  • 1
    Configure each interface with nmcli set eth0 autoconnect no to have them not come up automatically. @ArtemS.Tashkinov comment is better though.
    – doneal24
    Nov 15, 2023 at 15:22
  • @ArtemS.Tashkinov how this can be done ? Nov 18, 2023 at 23:14

2 Answers 2

1

In Debian 12, iptables is by default a wrapper for the new nftables subsystem. The iptables-persistent package depends on package netfilter-persistent, which creates a service named netfilter-persistent.service which is aliased to both iptables.service and ip6tables.service.

The netfilter-persistent.service is defined like this:

systemctl cat netfilter-persistent.service

# /lib/systemd/system/netfilter-persistent.service
[Unit]
Description=netfilter persistent configuration
DefaultDependencies=no
Wants=network-pre.target systemd-modules-load.service local-fs.target
Before=network-pre.target shutdown.target
After=systemd-modules-load.service local-fs.target
Conflicts=shutdown.target
Documentation=man:netfilter-persistent(8)

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/netfilter-persistent start
ExecStop=/usr/sbin/netfilter-persistent stop

[Install]
WantedBy=multi-user.target

# /usr/lib/systemd/system/netfilter-persistent.service.d/iptables.conf
[Install]
Alias=iptables.service ip6tables.service

Note DefaultDependencies=no, Wants=network-pre.target and Before=network-pre.target. These already ensure that the iptables/nftables rules are restored before any network interface gets configured, assuming that you use any of the expected ways to configure network interfaces.

So the answer is, yes, iptables-persistent gets loaded before any network interfaces are started.

If you want to make your own custom service for your iptables/nftables rules, you should set the dependencies of that service the same way netfilter-persistent.service does.

See the documentation of network-pre.target on the systemd.special(7) man page (emphasis mine):

network-pre.target

This passive target unit may be pulled in by services that want to run before any network is set up, for example for the purpose of setting up a firewall. All network management software orders itself after this target, but does not pull it in. Also see Running Services After the Network Is Up for more information.

0

Depends on your distro, e.g. Fedora Linux does that for you. It's weird your distro doesn't - that's a security vulnerability absolutely worth reporting and fixing. Systemd has dependencies for loading units, you need to make networking depend on your firewall unit. If you're using a different init system, consult with it.

1
  • I was not sure about this, hence why asked. Nov 27, 2023 at 21:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .