Public bug reported:
[Impact]
The iptables-persistent plugins/{15-ip4tables,25-ip6tables}
use ip[6]tables-restore without --noflush unconditionally.
This doesn't play along well with ufw, which starts before
netfilter-persistent typically, and gets its rules flushed.
This makes `ufw status` return that ufw is disabled, which
is misleading, as `ufw.service` is enabled and ufw actually
loaded all its rules correctly (but they were flushed later.)
Some images ship iptables-persistent rules, thus are subject
to this issue if ufw is used.
[Workaround]
Disable the netfilter-persistent.service unit, after rules
have been migrated to ufw.
[Fix]
Proposed in Debian bug #998416 [1]
[Test Steps]
See the Debian bug.
[1] https://bugs.debian.org/998416
** Affects: iptables-persistent (Ubuntu)
Importance: Medium
Assignee: Mauricio Faria de Oliveira (mfo)
Status: Confirmed
** Affects: iptables-persistent (Debian)
Importance: Unknown
Status: Unknown
** Changed in: iptables-persistent (Ubuntu)
Status: New => Confirmed
** Changed in: iptables-persistent (Ubuntu)
Importance: Undecided => Medium
** Changed in: iptables-persistent (Ubuntu)
Assignee: (unassigned) => Mauricio Faria de Oliveira (mfo)
** Bug watch added: Debian Bug tracker #998416
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998416
** Also affects: iptables-persistent (Debian) via
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998416
Importance: Unknown
Status: Unknown
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1949643
Title:
iptables-persistent unconditionally drops existing iptables rules
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/iptables-persistent/+bug/1949643/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
