[Bug 1949643] [NEW] iptables-persistent unconditionally drops existing iptables rules

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Ubuntu Foundations Team Bug Bot (crichton):

[Impact]

The iptables-persistent plugins/{15-ip4tables,25-ip6tables}
use ip[6]tables-restore without --noflush unconditionally.

This doesn't play along well with ufw, which starts before
netfilter-persistent typically, and gets its rules flushed.

This makes `ufw status` return that ufw is disabled, which
is misleading, as `ufw.service` is enabled and ufw actually
loaded all its rules correctly (but they were flushed later.)

Some images ship iptables-persistent rules, thus are subject
to this issue if ufw is used.

[Workaround]

Disable the netfilter-persistent.service unit, after rules
have been migrated to ufw.

[Fix]

Proposed in Debian bug #998416 [1], Salsa Merge Request [2].

[Test Steps]

See the Debian bug.

[1] https://bugs.debian.org/998416
[2] https://salsa.debian.org/debian/iptables-persistent/-/merge_requests/3

** Affects: iptables-persistent (Ubuntu)
     Importance: Medium
     Assignee: Mauricio Faria de Oliveira (mfo)
         Status: Confirmed

** Affects: iptables-persistent (Debian)
     Importance: Unknown
         Status: Fix Released


** Tags: patch
-- 
iptables-persistent unconditionally drops existing iptables rules
https://bugs.launchpad.net/bugs/1949643
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is subscribed to the bug report.