From: nada <nada@verdnatura.es>
To: pve-user@lists.proxmox.com
Subject: [PVE-User] migration from iptables to nftables
Date: Fri, 21 Jul 2023 11:49:33 +0200 [thread overview]
Message-ID: <3fec86b989521833db41524a04fc9a37@verdnatura.es> (raw)
hi folks
I am testing migration of firewall from iptables to nftables
my versions
* pve-manager/7.4-16/0f39f621 (running kernel: 5.15.108-1-pve)
* iptables 1.8.7-1
* nftables 0.9.8-3.1+deb11u1
# nft -V
nftables v0.9.8 (E.D.S.)
cli: editline
json: yes
minigmp: no
libxtables: yes
I've already translated rulesets from iptables to nftables
and want to deploy them at pve-firewall
PLS can anybody let me know the configuration of pve-firewall.service
for nft ?
current for iptables
# cat /lib/systemd/system/pve-firewall.service
[Unit]
Description=Proxmox VE firewall
ConditionPathExists=/usr/sbin/pve-firewall
Wants=pve-cluster.service pvefw-logger.service
After=pvefw-logger.service pve-cluster.service network.target
systemd-modules-load.service
DefaultDependencies=no
Before=shutdown.target
Conflicts=shutdown.target
[Service]
ExecStartPre=-/usr/bin/update-alternatives --set ebtables
/usr/sbin/ebtables-legacy
ExecStartPre=-/usr/bin/update-alternatives --set iptables
/usr/sbin/iptables-legacy
ExecStartPre=-/usr/bin/update-alternatives --set ip6tables
/usr/sbin/ip6tables-legacy
ExecStart=/usr/sbin/pve-firewall start
ExecStop=/usr/sbin/pve-firewall stop
ExecReload=/usr/sbin/pve-firewall restart
PIDFile=/run/pve-firewall.pid
Type=forking
[Install]
WantedBy=multi-user.target
thank you
NadaMac
reply other threads:[~2023-07-21 9:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3fec86b989521833db41524a04fc9a37@verdnatura.es \
--to=nada@verdnatura.es \
--cc=pve-user@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox