Am 28.06.21 um 09:32 schrieb Alessandro Vesely:
On Sat 26/Jun/2021 12:43:45 +0200 Reindl Harald wrote:
/usr/sbin/ipset -file /etc/sysconfig/ipset restore
/usr/sbin/iptables-nft-restore /etc/sysconfig/iptables
/usr/sbin/sysctl -q --load=/etc/sysctl*.conf
that way first all rules are loaded atomic and *then* "ip_forward"
and friends are set to avoid a leak at boot
it may be good for you pro administrators with complex
configurations...I have all in one file and do not need to bother
about 1ms lost during reload nor seeking 10 different config files
for simple tasks and wasting hours by config. I like easy life.
mixing things together which don't belong together like iptables and
sysctl is the opposite of simple as well as running a ton of commands
at boot where it should be a oneliner is also the opposite
I'm with David here. Besides sysctl and ipset, there are lots of ip
commands, modprobe's, vconfig, and a couple of home-brewed daemons
(ipqbdb). A soundly commented script captures the logic of the network
and can be maintained with more coherence than raw commands accumulated
along the way. The only drawback is that most changes, for example
punching a hole in the firewall, have to be applied twice, in the boot
script as well as directly in a terminal.
and what does this different at boot besides that it's faster and atomic
compared to a complex and error prone script?
/usr/sbin/ipset -file /etc/sysconfig/ipset restore
/usr/sbin/iptables-nft-restore /etc/sysconfig/iptables
/usr/sbin/sysctl -q --load=/etc/sysctl*.conf
-------------
guess what - i maintain network configs with a single systemd-unit but
that don't justify not using "restore" commands when they exist and are
appropriate for the task
-------------
[root@testserver:~]$ cat /etc/systemd/system/network-up.service
[Unit]
DefaultDependencies=no
RefuseManualStop=yes
Description=Network
PartOf=basic.target
PartOf=network-online.target
Before=crond.service timers.target vnstat.service vmtoolsd.service
# Sicherstellen dass Netzwerk-Devices von 'udev' umbenannt wurden
After=sys-subsystem-net-devices-lan.device
sys-subsystem-net-devices-wan.device
Wants=sys-subsystem-net-devices-lan.device
sys-subsystem-net-devices-wan.device
[Service]
Type=oneshot
RemainAfterExit=yes
SuccessExitStatus=80
TimeoutStartSec=60
# Firewall-Regeln laden
ExecStart=/usr/sbin/ipset -file /etc/sysconfig/ipset restore
ExecStart=/usr/sbin/iptables-nft-restore /etc/sysconfig/iptables
ExecStart=/usr/sbin/ip6tables-nft-restore /etc/sysconfig/ip6tables
# LAN-Interface konfiguieren
ExecStart=-/usr/sbin/ip addr add 192.168.196.12/255.255.255.0 broadcast
192.168.196.255 dev lan
ExecStart=-/usr/sbin/ip link set dev lan up
# WAN konfigurieren
ExecStart=-/usr/bin/systemctl start network-wan-dhcp.service
# NIC-Konfiguration
ExecStart=-/usr/sbin/ethtool -G lan rx 512 tx 256
ExecStart=-/usr/sbin/ethtool -K lan lro off
ExecStart=-/usr/sbin/ethtool -G wan rx 512 tx 256
ExecStart=-/usr/sbin/ethtool -K wan lro off
# Routing von VPN/Host-Netzwerken
ExecStart=-/usr/sbin/ip route add 10.0.0.0/24 via 192.168.196.2 dev lan
ExecStart=-/usr/sbin/ip route add 172.17.0.0/24 via 192.168.196.2 dev lan
ExecStart=-/usr/sbin/ip route add 192.168.11.0/24 via 192.168.196.2 dev lan
# Sicherstellen dass 'sysctl' angewendet wird
ExecStart=-/usr/sbin/sysctl -q --load=/etc/sysctl*.conf
[Install]
WantedBy=basic.target
-------------
[root@testserver:~]$ cat /etc/systemd/system/network-wan-dhcp.service
[Unit]
Description=Internet DHCP-Client
[Service]
ExecStartPre=-/usr/sbin/ip link set dev wan multicast off allmulticast
off up
ExecStart=/usr/sbin/dhclient -4 -q --no-pid --request-options
subnet-mask,broadcast-address,routers wan
Type=forking
PermissionsStartOnly=yes
SuccessExitStatus=80
Restart=always
RestartSec=5
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=-/var/lib/dhclient
PrivateTmp=yes
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
MemoryDenyWriteExecute=yes
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
CAP_NET_BROADCAST CAP_NET_RAW
LockPersonality=yes
PrivateDevices=yes
ProtectHostname=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
UMask=077
SystemCallArchitectures=native
SystemCallFilter=@system-service @network-io @privileged
SystemCallFilter=~@aio @chown @clock @cpu-emulation @debug @keyring
@module @mount @obsolete @raw-io @reboot @resources @swap
InaccessiblePaths=-/boot
InaccessiblePaths=-/efi
InaccessiblePaths=-/root
