Closed tomdoyle87 closed 5 years ago
Hi, I think I have a solution for apf not stopping when iptables fails to start. The main issue I had that the iptables processes exits after processing the rules and passes the work on to the kernel modules. So its pointless monitoring the process, instead monitoring the logs seems like a possible solution. This is far from perfect, again more of a start/suggestion.
/usr/local/sbin/start-apf.sh
#!/bin/bash
/usr/local/sbin/apf --start
if grep --quiet "unable to load iptables" /var/log/messages; then
/usr/local/sbin/apf --stop
else
echo not found
fi
The script checks the system log for any occurrences of iptables not loading; if found apf is stops. I realise in its current form this only works on redhat/redhat based GNU/Linux. Replacing /var/log/messages with /var/log/syslog for debian based. This could done on install with cat /etc/proc ?
chmod + /usr/local/sbin/start-apf.sh
/usr/lib/systemd/system/apf.service
[Unit]
Description=apf firewall with iptables
After=syslog.target network.target
[Service]
RemainAfterExit=yes
ExecStart=/usr/local/sbin/start-apf.sh
ExecStop=/usr/local/sbin/apf --stop
Restart=on-failure
RestartSec=5
[Install]
WantedBy=basic.target
systemctl daemon-reload
systemctl restart apf
This needs testing, as I am unable to produce or anything similar:
Thanks Tom.
Hi,
I believe I have a working solution for the apf service to fail, if apf doesn't start correctly:
/etc/systemd/system/apf.service:
[Unit]
Description=apf firewall with iptables
After=syslog.target network.target
[Service]
Type=oneshot
RemainAfterExit=true
ExecStart=/usr/local/sbin/apf-start.sh
ExecStop=/usr/local/sbin/apf --stop
[Install]
WantedBy=basic.target
/usr/local/sbin/apf-start.sh:
#!/bin/bash
/usr/local/sbin/apf --start &> /tmp/check-apf
if egrep 'unable to load iptables module|timed out while attempting to gain lock|could not process allow_hosts|could not process deny_hosts|apf does not appear to have rules loaded|could not verify that interface|trust rules unchanged since last refresh' /tmp/check-apf; then
/usr/local/sbin/apf --stop
echo "APF Aborted"
exit 1
else
echo "All ok"
fi
exit 0
From looking at /etc/apf/internals/functions.apf, the egrep should cover all possible errors; please let me know if that is not the case.
I have confirmed results in systemd failure by changing un-trusted interface to a interface which doesn't exist on my system.
Thanks Tom.
Hi,
init.d does not report any issues with apf:
/etc/init.d/apf start Starting apf (via systemctl): [ OK ]
Will report OK even if iptables is not running for example:
https://www.eukhost.com/blog/webhosting/apf-unable-to-load-iptables-module-ip_tables/
Currently only starting apf manually or iptables -S would show if there is an issue. If started with systemd unit:
status will advise if iptables is running or not:
systemctl status apf
Systemd unit file can probably be improved to actaul fail if iptables, this more of a start/suggestion.
Thanks