iptables systemd systemctl

1. 

# Ubuntu - WARNING: Iptables and NetworkManager can conflict
$ sudo apt remove network-manager
or
$ sudo apt --purge remove network-manager   # use with caution

2. iptables version1.8.3

# There are 5 methods to run iptables automatically at Startup

3. rc-local.service

# Method 1

# rc-local.service - /etc/rc.d/rc.local

# systemctl status rc-local.service

# chmod a+x /etc/rc.d/rc.local; ll /etc/rc.d/rc.local
# systemctl daemon-reload

# systemctl list-dependencies multi-user.target | grep rc-local

# chown root:root /etc/iptables.start.rules
# chmod 700 /etc/iptables.start.rules

# echo "/etc/iptables.start.rules" >> /etc/rc.d/rc.local

4.  利用systemd 构建 serivce

#
# Method 2

# Systemctl Service
# /usr/lib/systemd/system - system level
# /etc/systemd/system - user level


# 2.1
# sudo bash iptables.autoconf.sh

# cat iptables.autoconf.sh
#!/bin/bash
#

# disable ufw service
systemctl disable ufw.service

# copy the appropriate files to the target location
cp ./iptables.{start,stop}.rules /etc/
cp ./iptables.service /etc/systemd/system/

# make the iptables script executable
chmod a+x /etc/iptables.{start,stop}.rules

# apply the customized iptables rules
/bin/bash /etc/iptables.start.rules

# dump iptables rules to a file
/sbin/iptables-save > /etc/iptables.start.rules

# enable the unit
systemctl enable iptables.service


#
# Customizing Service
$ cat /etc/systemd/system/iptables.service

[Unit]
Description=iptables firewall
Documentation=man:iptables(8)
DefaultDependencies=no
Before=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "/sbin/iptables-restore < /etc/iptables.start.rules"
ExecStop=/bin/bash -c "/etc/iptables.stop.rules"

[Install]
WantedBy=multi-user.target

# enable the unit
$ sudo systemctl enable iptables.service

#
# disable and remove the symlinked service

$ sudo systemctl disable iptables.service
$ sudo rm /etc/systemd/system/iptables.service

5. 利用systemd 构建 serivce，脚本模式

# 2.2
# sudo bash iptables.script.autoconf.sh

# cat iptables.script.autoconf.sh
#!/bin/bash
#

# disable ufw service
systemctl disable ufw.service

# copy the appropriate files to the target location
cp ./iptables.{start,stop}.rules /etc/
cp ./iptables.script.service /etc/systemd/system/

# make the iptables script executable
chmod a+x /etc/iptables.{start,stop}.rules

# apply the customized iptables rules
/bin/bash /etc/iptables.start.rules

# enable the unit
systemctl enable iptables.script.service

#
# disable and remove the symlinked service

$ sudo systemctl disable iptables.script.service
$ sudo rm /etc/systemd/system/iptables.script.service


#
# Customizing Service
$ cat /etc/systemd/system/iptables.script.service

[Unit]
Description=iptables firewall
Documentation=man:iptables(8)
DefaultDependencies=no
Before=network.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "/etc/iptables.start.rules"
ExecStop=/bin/bash -c "/etc/iptables.stop.rules"

[Install]
WantedBy=multi-user.target

6. iptables-persistent

#
# Method 3

# iptables-persistent
# Install and use the iptables-persistent package

$ sudo apt install iptables-persistent

7.

#
# Method 4  #(might be obsolete)
/etc/network/interfaces

8.

#
# Method 5 #(might be obsolete)
/etc/network/if-pre-up.d
/etc/network/if-post-down.d

9. reference