Budowa skryptu uslugi firewalla iptables.
: 19 kwie 2017, 17:14
Moja wersja dystrybucji Ubuntu:
Wersja Kernela:
Uzywam Systemd:
lub:
Zainstalowane iptables:
Sciezka "firewall service"
Content "firewall service"
Plik konfigu iptables (base.sh + iptable.sh) na sciezce:
Content "base.sh" (probny)
Content "iptable.sh" (probny)
Nastepnie dalem komendy:
Wynik:
lub:
lub:
Bardzo wazne jest zeby usluga firewall.service "wstawala" przed karta sieciowa.
PROBLEM:
Systemd nie podnosi uslugi przy startupie. Komunikat startowy "Failed to start firewall"
Mysle, ze plik unitu albo uslugi zawiera bledy.
Bardzo prosze o pomoc w naprawie i linka do skutecznej budowy uslug w Systemd zebym w przyszlosci mogl sam rozwiazywac problemy.
Kod: Zaznacz cały
lsb_release -a
LSB Version: core-9.20160110ubuntu5-amd64:core-9.20160110ubuntu5-noarch:security-9.20160110ubuntu5-amd64:security-9.20160110ubuntu5-noarch
Distributor ID: Ubuntu
Description: Ubuntu 16.10
Release: 16.10
Codename: yakkety
Kod: Zaznacz cały
cat /proc/version
Linux version 4.8.0-39-generic (buildd@lgw01-59) (gcc version 6.2.0 20161005 (Ubuntu 6.2.0-5ubuntu12) ) #42-Ubuntu SMP Mon Feb 20 11:47:27 UTC 2017Kod: Zaznacz cały
ps --no-headers -o comm 1
systemd
Kod: Zaznacz cały
systemd --version
systemd 231
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDNKod: Zaznacz cały
apt-cache policy iptables
iptables:
Installed: 1.6.0-3ubuntu2
Candidate: 1.6.0-3ubuntu2
Version table:
*** 1.6.0-3ubuntu2 500
500 http://ie.archive.ubuntu.com/ubuntu yakkety/main amd64 Packages
500 http://us.archive.ubuntu.com/ubuntu yakkety/main amd64 Packages
100 /var/lib/dpkg/status
Kod: Zaznacz cały
etc/systemd/system/firewall serviceKod: Zaznacz cały
[Unit]
Description=firewall
Documentation=man:iptables
DefaultDependencies=no
Wants=network-pre.target systemd-modules-load.service
Before=network-pre.target
After=systemd-modules-load.service
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c "/etc/filtr/iptable.sh"
ExecStop=/bin/sh -c "/etc/filtr/base.sh"
[Install]
WantedBy=multi-user.target
Kod: Zaznacz cały
/etc/filtr/base.sh + iptable.shKod: Zaznacz cały
#!/bin/sh
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ip6t -P INPUT DROP
$ip6t -P FORWARD DROP
$ip6t -P OUTPUT ACCEPT
for iptable in $ipt $ip6t
do
for table in \
"-t raw" \
"-t mangle" \
"-t filter" \
"-t nat"
do
$iptable $table -F
$iptable $table -X
done
Kod: Zaznacz cały
#!/bin/sh
ipt="$(which iptables) -t filter"
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -F
$ipt -X
conntrack -F
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -F
ip6tables -X
Kod: Zaznacz cały
systemctl start firewall.serviceKod: Zaznacz cały
systemctl enable firewall.serviceKod: Zaznacz cały
systemctl status firewall.service
● firewall.service - firewall
Loaded: loaded (/etc/systemd/system/firewall.service; enabled; vendor preset:
Active: failed (Result: exit-code) since Wed 2017-04-19 15:24:49 IST; 1h 0min
Docs: man:iptables
Main PID: 332 (code=exited, status=126)Kod: Zaznacz cały
systemctl is-active firewall.service
failed
Kod: Zaznacz cały
systemctl --all --failed --type=error --type=not-found --no-legend
org.freedesktop.network1.busname not-found inactive dead org.freedesktop.netwo
org.freedesktop.resolve1.busname not-found inactive dead org.freedesktop.resol
tmp.mount not-found inactive dead tmp.mount
auditd.service not-found inactive dead auditd.service
console-screen.service not-found inactive dead console-screen.service
festival.service not-found inactive dead festival.service
firewall.service loaded failed failed firewall
iscsid.service not-found inactive dead iscsid.service
kbd.service not-found inactive dead kbd.service
lvm2-activation.service not-found inactive dead lvm2-activation.service
netfilter-persistent.service loaded failed failed netfilter persistent conf
networking.service loaded failed failed Raise network interfaces
snapd.boot-ok.service not-found inactive dead snapd.boot-ok.service
snapd.firstboot.service not-found inactive dead snapd.firstboot.service
systemd-sysusers.service not-found inactive dead systemd-sysusers.service
systemd-update-done.service not-found inactive dead systemd-update-done.servi
systemd-vconsole-setup.service not-found inactive dead systemd-vconsole-setup.
syslog.target not-found inactive dead syslog.targetPROBLEM:
Systemd nie podnosi uslugi przy startupie. Komunikat startowy "Failed to start firewall"
Mysle, ze plik unitu albo uslugi zawiera bledy.
Bardzo prosze o pomoc w naprawie i linka do skutecznej budowy uslug w Systemd zebym w przyszlosci mogl sam rozwiazywac problemy.