iptables-restore sometimes fails on reboot
I still suspect that two executions of /etc/network/if-pre-up.d/iptables
are running at the same time throughout the boot process. Because of systemd
normal behavior of starting things concurrently unless advised not to do so, I believe the boot process triggers one script process for the lo
interface and another for the ens16
interface. That would result in a concurrent execution of iptables-restore
, which may cause errors such as iptables-restore: line 10 failed
. I am unable to supply evidences though.
I am used to managing CentOS and Red Hat systems. Once upon a time, one of such servers failed to initialize iptables
service on boot because systemd
was starting ip6tables
concurrently. That specific error is documented here: https://bugzilla.redhat.com/show_bug.cgi?id=1477413
I suggest you to handle concurrency in your script, for example, by using flock
:
#!/bin/sh
/usr/bin/flock /run/.iptables-restore /sbin/iptables-restore < /etc/iptables.up.rules
Alternatively, you could check the actual value of ${IFACE}
variable before restoring iptables
rules (reference: man 5 interfaces):
#!/bin/sh
if [ "${IFACE}" == ens16 ]; then
/sbin/iptables-restore < /etc/iptables.up.rules
fi
Additionally, if you just want to load iptables
rules at boot time, I suggest you to use iptables-persistent
instead:
# apt-get install iptables-persistent netfilter-persistent
# mv -v /etc/iptables.up.rules /etc/iptables/rules.v4
# systemctl enable netfilter-persistent.service
# rm -v /etc/network/if-pre-up.d/iptables