[Solved] Using systemd to restore firewall rules

Question

I've done plenty of Googlin' and come up nowhere near short on answers as to why this won't work. I've worked around and worked around and concluded that, finally, if I use this as a .service file, it **should** load my dear old iptables rules when I boot. This, in practice, has not been the case. What's wrong is probably a ridiculous semantic error, but I have concluded it would be considerably more effective to finally break down and ask someone rather than continue my mad workaround chain. So, without further rambling, I wrote this .service file to run "iptables-restore < /root/fw.fw" through bash on startup:
[Unit]
Description=Firewall Automatic start and stop service
[Service]
Type=simple
ExecStart=/bin/bash -c "/usr/sbin/iptables-restore < /root/fw.fw"
ExecStop=/usr/sbin/iptables -F
[Install]
WantedBy=multi-user.target
Can anyone identify my mistake?
When I do systemctl start ewall.service, I get no output, and iptables -L -v reports no changes. When I systemctl enable ewall.service, it tells me the same thing it would for anything which wants multi-user.target to want it. When I reboot with it enabled, still no changes when I talk to iptables via -L -v.
Last edited by Thisguy_ (2012-12-23 17:44:36)

Answer 1

What's wrong with the iptables.service included with iptables?
If you want to know specifically, your problem is that you've defined the service as Type=simple. It should be type oneshot. The shell invocation is useless as well because iptables-restore can take a file as an argument. It doesn't need to read from stdin. At this point, you're pretty much using what the iptables.service included with iptables provides...
Last edited by falconindy (2012-12-22 16:41:21)