Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #187952 > unrolled thread
| Started by | Stephane L <stephanel35@yahoo.fr> |
|---|---|
| First post | 2017-10-17 14:10 +0200 |
| Last post | 2017-10-20 05:10 +0200 |
| Articles | 6 — 4 participants |
Back to article view | Back to linux.debian.user
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
way of starting a firewall script in debian 9 with kde5 and sddm Stephane L <stephanel35@yahoo.fr> - 2017-10-17 14:10 +0200
Re: way of starting a firewall script in debian 9 with kde5 and sddm Ben Caradoc-Davies <ben@transient.nz> - 2017-10-17 14:30 +0200
Re: way of starting a firewall script in debian 9 with kde5 and sddm Stephane L <stephanel35@yahoo.fr> - 2017-10-17 14:40 +0200
Re: way of starting a firewall script in debian 9 with kde5 and sddm Tim <debian-bugreport@quuck.eu> - 2017-10-17 23:20 +0200
Re: way of starting a firewall script in debian 9 with kde5 and sddm Richard Hector <richard@walnut.gen.nz> - 2017-10-20 04:30 +0200
Re: way of starting a firewall script in debian 9 with kde5 and sddm Ben Caradoc-Davies <ben@transient.nz> - 2017-10-20 05:10 +0200
| From | Stephane L <stephanel35@yahoo.fr> |
|---|---|
| Date | 2017-10-17 14:10 +0200 |
| Subject | way of starting a firewall script in debian 9 with kde5 and sddm |
| Message-ID | <uByR3-1ZX-5@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Hi,I have a firewall script(firewall) that I laucnh with <firewall start>Is there a way in debian 9 (with kde5 and sddm) to start this script at the boot of the linux system or at the launching of xorg or of kde5 ? Thanks
[toc] | [next] | [standalone]
| From | Ben Caradoc-Davies <ben@transient.nz> |
|---|---|
| Date | 2017-10-17 14:30 +0200 |
| Message-ID | <uBzaq-27i-11@gated-at.bofh.it> |
| In reply to | #187952 |
On 18/10/17 01:08, Stephane L wrote: > Hi,I have a firewall script(firewall) that I laucnh with <firewall start>Is there a way in debian 9 (with kde5 and sddm) to start this script at the boot of the linux system or at the launching of xorg or of kde5 ? systemd units are easy to write (this is the main benefit of systemd) and can be configured run at boot time. Here is one I wrote for iptables+ip6tables (because I do not want changes to persist across boots, just clean rules on boot). You will need a different Type if your program does not exit: $ cat /etc/iptables/iptables.service [Unit] Description=iptables rules After=network.target [Service] Type=oneshot ExecStart=/bin/bash -c "/sbin/iptables-restore < /etc/iptables/iptables.rules" ExecStart=/bin/bash -c "/sbin/ip6tables-restore < /etc/iptables/ip6tables.rules" RemainAfterExit=yes ExecStop=/sbin/iptables -F ExecStop=/sbin/ip6tables -F [Install] WantedBy=multi-user.target I enabled it with: systemctl enable /etc/iptables/iptables.service This should add the required symlink in /etc/systemd/system . Kind regards, -- Ben Caradoc-Davies <ben@transient.nz> Director Transient Software Limited <http://transient.nz/> New Zealand
[toc] | [prev] | [next] | [standalone]
| From | Stephane L <stephanel35@yahoo.fr> |
|---|---|
| Date | 2017-10-17 14:40 +0200 |
| Subject | Re: way of starting a firewall script in debian 9 with kde5 and sddm |
| Message-ID | <uBzk6-2bh-11@gated-at.bofh.it> |
| In reply to | #187960 |
[Multipart message — attachments visible in raw view] — view raw
thank you very much ben, I will try this toobests regards
stephane
Le Mardi 17 octobre 2017 14h26, Ben Caradoc-Davies <ben@transient.nz> a écrit :
On 18/10/17 01:08, Stephane L wrote:
> Hi,I have a firewall script(firewall) that I laucnh with <firewall start>Is there a way in debian 9 (with kde5 and sddm) to start this script at the boot of the linux system or at the launching of xorg or of kde5 ?
systemd units are easy to write (this is the main benefit of systemd)
and can be configured run at boot time. Here is one I wrote for
iptables+ip6tables (because I do not want changes to persist across
boots, just clean rules on boot). You will need a different Type if your
program does not exit:
$ cat /etc/iptables/iptables.service
[Unit]
Description=iptables rules
After=network.target
[Service]
Type=oneshot
ExecStart=/bin/bash -c "/sbin/iptables-restore <
/etc/iptables/iptables.rules"
ExecStart=/bin/bash -c "/sbin/ip6tables-restore <
/etc/iptables/ip6tables.rules"
RemainAfterExit=yes
ExecStop=/sbin/iptables -F
ExecStop=/sbin/ip6tables -F
[Install]
WantedBy=multi-user.target
I enabled it with:
systemctl enable /etc/iptables/iptables.service
This should add the required symlink in /etc/systemd/system .
Kind regards,
--
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <http://transient.nz/>
New Zealand
[toc] | [prev] | [next] | [standalone]
| From | Tim <debian-bugreport@quuck.eu> |
|---|---|
| Date | 2017-10-17 23:20 +0200 |
| Message-ID | <uBHrk-89R-1@gated-at.bofh.it> |
| In reply to | #187960 |
On Wed, 2017-10-18 at 01:25 +1300, Ben Caradoc-Davies wrote:
> On 18/10/17 01:08, Stephane L wrote:
> > Hi,I have a firewall script(firewall) that I laucnh with <firewall
> > start>Is there a way in debian 9 (with kde5 and sddm) to start this
> > script at the boot of the linux system or at the launching of xorg
> > or of kde5 ?
>
> systemd units are easy to write (this is the main benefit of systemd)
> and can be configured run at boot time. Here is one I wrote for
> iptables+ip6tables (because I do not want changes to persist across
> boots, just clean rules on boot). You will need a different Type if your
> program does not exit:
>
> $ cat /etc/iptables/iptables.service
> [Unit]
> Description=iptables rules
> After=network.target
> [Service]
> Type=oneshot
> ExecStart=/bin/bash -c "/sbin/iptables-restore <
> /etc/iptables/iptables.rules"
> ExecStart=/bin/bash -c "/sbin/ip6tables-restore <
> /etc/iptables/ip6tables.rules"
> RemainAfterExit=yes
> ExecStop=/sbin/iptables -F
> ExecStop=/sbin/ip6tables -F
> [Install]
> WantedBy=multi-user.target
Good to know that there is a replacement for {ip,ip6,arp,eb}tables,
I'll look into this once I have found some time.
However, I was just wondering what the difference is between your
script and iptables-persistent. Wouldn't both restore the iptables
configuration form a single file? Or is there some other benefit by
choosing one over the other (besides a personal preference)?
Best,
Tim
[toc] | [prev] | [next] | [standalone]
| From | Richard Hector <richard@walnut.gen.nz> |
|---|---|
| Date | 2017-10-20 04:30 +0200 |
| Message-ID | <uCvep-6rM-1@gated-at.bofh.it> |
| In reply to | #187960 |
[Multipart message — attachments visible in raw view] — view raw
On 18/10/17 01:25, Ben Caradoc-Davies wrote: > On 18/10/17 01:08, Stephane L wrote: >> Hi,I have a firewall script(firewall) that I laucnh with <firewall >> start>Is there a way in debian 9 (with kde5 and sddm) to start this >> script at the boot of the linux system or at the launching of xorg or >> of kde5 ? > > systemd units are easy to write (this is the main benefit of systemd) > and can be configured run at boot time. Here is one I wrote for > iptables+ip6tables (because I do not want changes to persist across > boots, just clean rules on boot). You will need a different Type if your > program does not exit: > > $ cat /etc/iptables/iptables.service > [Unit] > Description=iptables rules > After=network.target > [Service] > Type=oneshot > ExecStart=/bin/bash -c "/sbin/iptables-restore < > /etc/iptables/iptables.rules" > ExecStart=/bin/bash -c "/sbin/ip6tables-restore < > /etc/iptables/ip6tables.rules" > RemainAfterExit=yes > ExecStop=/sbin/iptables -F > ExecStop=/sbin/ip6tables -F > [Install] > WantedBy=multi-user.target > > I enabled it with: > > systemctl enable /etc/iptables/iptables.service > > This should add the required symlink in /etc/systemd/system . Mine's a bit different, and rather shorter ... any comments welcome: /etc/systemd/system/firewall.service: --------------------------------------- [Unit] Before=network-pre.target [Service] ExecStart=/etc/network/firewall Type=oneshot RemainAfterExit=yes [Install] WantedBy=network.target --------------------------------------- I don't want the network up without the firewall, so it goes before the network. Likewise, I don't want it ever down, so there's no ExecStop. /etc/network/firewall is a short script that sources firewall4 (and firewall6 if I had one. I probably should ...). I wasn't aware of or familiar with the idea of putting it somewhere else and enabling/disabling it; I'm not sure if I need that. Richard
[toc] | [prev] | [next] | [standalone]
| From | Ben Caradoc-Davies <ben@transient.nz> |
|---|---|
| Date | 2017-10-20 05:10 +0200 |
| Message-ID | <uCvR7-6Td-3@gated-at.bofh.it> |
| In reply to | #188107 |
On 20/10/17 15:21, Richard Hector wrote: > I wasn't aware of or familiar with the idea of putting it somewhere else > and enabling/disabling it; I'm not sure if I need that. I just did it for convenient selective backup together with the rules files, and consistency with other services which use symlinks to /lib and /usr/share. With the unit .service file in /etc/systemd/system, everything should work, but I do not know that happens if you use systemctl to mask the service (normally this places a link in /etc/systemd/system to /dev null). I have only symlinks and directories in /etc/systemd/system. Kind regards, -- Ben Caradoc-Davies <ben@transient.nz> Director Transient Software Limited <http://transient.nz/> New Zealand
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web