2

I use netfilter-persistent to manage a firewall.

I would like to share a connection between two interfaces using masquerading (example, or another). When I run those operations by invoking iptables it works.

But if I try to update firewall rules stored in /etc/iptables/rules.v4 adding such a line: 

-t nat -A POSTROUTING -o wlan0 -j MASQUERADE

Lines starting with -t make netfilter-persistent fail to run and the firewall is not updated:

Nov 16 11:51:32 helena systemd[1]: netfilter-persistent.service: Main process exited, code=exited, status=1/FAILURE
Nov 16 11:51:32 helena systemd[1]: Failed to start netfilter persistent configuration.

So I am wondering if it is possible to store this kind of rules with netfilter-persistent or

  • Is it a known limitation?
  • Is there a good reason why it cannot work?
  • Is there a hack to make it work?
0xC0000022L
  • 16,189
  • 24
  • 102
  • 168
jlandercy
  • 135
  • 1
  • 7

1 Answers1

5

You're probably adding a rule intended for the nat table in the filter table block suitable for iptables-restore, and with inappropriate syntax.

Until you know how to edit /etc/iptables/rules.v4 directly (by studying the output of iptables-save), you should do this instead:

  • be careful, since the rule will be applied immediately,

  • change the current running firewall rules with:

    iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

  • study the results: are they worth changing the configuration?

  • if worthy, ask netfilter-persistent to save the rules. It will in turn run iptables-persistent's plugins which will use iptables-save under the hood.

    netfilter-persistent save

You will notice that the new configuration file (a file suitable for use by iptables-restore) now has a block for the nat table with your rule (and without -t nat), separate from the filter table block.

A.B
  • 31,762
  • 2
  • 62
  • 101
  • 1
    This has the added advantage that you've saved only a known good ruleset, so when you accidentally lock yourself out a reboot will restore the last working ruleset. – roaima Dec 23 '18 at 17:17
  • 1
    Yes, if the remote user thinks about reconnecting a 2nd time before saving and leaving. Sometimes the connection stays up only because of the conntrack stateful rule, and the next time gives a surprise. – A.B Dec 23 '18 at 17:37
  • 1
    I've occasionally set up a cron rule to erase the entire iptables ruleset after 10 minutes of a marker file having been last updated. Has conveniently saved me a number of times. – roaima Dec 23 '18 at 17:50