You are not logged in.

  1. Index
  2. » Scripts, Tutorials & Tips
  3. » Firewall for the lazy

Pages: 1 2 3 4

#21 2016-06-17 22:54:13

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:

Try:

sudo journalctl -xn

You will have to provoke the error again first.

I ran the command again...

$ sudo systemctl start nftables

... and got same nftables.service failed message as before

Does nftabes.service start successfully during bootup or does it fail then too?

I'm not sure how to check for that.

I have just tried this in my BL system and everything works as expected.
However, the default /etc/nftables.conf has changed from a whitelist firewall to a completely open ruleset.

To get back the default-deny rules, use:

sudo cp /usr/share/doc/nftables/examples/syntax/workstation /etc/nftables.conf

Check the rules have been applied with `sudo nft list ruleset`

I'm not very technical but I have ran the following commands in terminal with the following results...

hugh@ASUS-BUNSENLABS:~$ sudo cp /usr/share/doc/nftables/examples/syntax/workstation /etc/nftables.conf
[sudo] password for hugh: 
hugh@ASUS-BUNSENLABS:~$ sudo nft list ruleset
hugh@ASUS-BUNSENLABS:~$
hugh@ASUS-BUNSENLABS:~$ sudo journalctl -xn
-- Logs begin at Fri 2016-06-17 23:21:19 BST, end at Fri 2016-06-17 23:44:07 BST. --
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: ^^^^^^^^^^^^^^
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: /etc/nftables.conf:3:1-14: Error: Could not process rule: Address family not supported by protocol
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: flush ruleset
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: ^^^^^^^^^^^^^^
Jun 17 23:42:41 ASUS-BUNSENLABS systemd[1]: nftables.service: main process exited, code=exited, status=1/FAILURE
Jun 17 23:42:41 ASUS-BUNSENLABS systemd[1]: Failed to start nftables.
-- Subject: Unit nftables.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit nftables.service has failed.
-- 
-- The result is failed.
Jun 17 23:42:41 ASUS-BUNSENLABS systemd[1]: Unit nftables.service entered failed state.
Jun 17 23:42:41 ASUS-BUNSENLABS sudo[1290]: pam_unix(sudo:session): session closed for user root
Jun 17 23:44:07 ASUS-BUNSENLABS sudo[1315]: hugh : TTY=pts/0 ; PWD=/home/hugh ; USER=root ; COMMAND=/bin/journalctl -xn
Jun 17 23:44:07 ASUS-BUNSENLABS sudo[1315]: pam_unix(sudo:session): session opened for user root by hugh(uid=0)
hugh@ASUS-BUNSENLABS:~$

Did I enter the commands correctly?  Does the output identify where the problem lies?  Thanks for your input, it is very much appreciated.

Offline

#22 2016-06-18 10:34:52

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:

Does nftabes.service start successfully during bootup or does it fail then too?

I'm not sure how to check for that.

Yes, sorry -- you can run `sudo nft list ruleset` after boot to see if the rules have been applied and you can use this command after boot to see if the .service has been started:

systemctl status nftables.service

The `systemctl start` command starts the .service immediately but the `systemctl enable` command is needed to make the .service start automatically at every boot thereafter.

On the other hand, if you just use `systemctl enable` then the .service does *not* start until the next boot up.

The man page covers this in great detail: systemctl(1)

hughparker1 wrote:
hugh@ASUS-BUNSENLABS:~$ sudo journalctl -xn
-- Logs begin at Fri 2016-06-17 23:21:19 BST, end at Fri 2016-06-17 23:44:07 BST. --
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: ^^^^^^^^^^^^^^
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: /etc/nftables.conf:3:1-14: Error: Could not process rule: Address family not supported by protocol
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: flush ruleset
Jun 17 23:42:41 ASUS-BUNSENLABS nft[1293]: ^^^^^^^^^^^^^^
Jun 17 23:42:41 ASUS-BUNSENLABS systemd[1]: nftables.service: main process exited, code=exited, status=1/FAILURE
Jun 17 23:42:41 ASUS-BUNSENLABS systemd[1]: Failed to start nftables.
-- Subject: Unit nftables.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit nftables.service has failed.
-- 
-- The result is failed.
Jun 17 23:42:41 ASUS-BUNSENLABS systemd[1]: Unit nftables.service entered failed state.
Jun 17 23:42:41 ASUS-BUNSENLABS sudo[1290]: pam_unix(sudo:session): session closed for user root
Jun 17 23:44:07 ASUS-BUNSENLABS sudo[1315]: hugh : TTY=pts/0 ; PWD=/home/hugh ; USER=root ; COMMAND=/bin/journalctl -xn
Jun 17 23:44:07 ASUS-BUNSENLABS sudo[1315]: pam_unix(sudo:session): session opened for user root by hugh(uid=0)
hugh@ASUS-BUNSENLABS:~$

Did I enter the commands correctly?  Does the output identify where the problem lies?

Yes, the problem is with the default /etc/nftables.conf which had an erroneous "flush ruleset" line at the top hmm

However, now that you have copied the "workstation" example to /etc/nftables.conf the `systemctl start nftables` command should now work if you try it again smile

Remember to `enable` it to start automatically.

Check for all enabled .services (& .targets & .sockets) with:

systemctl list-unit-files | grep enabled

Para todos todo, para nosotros nada

Offline

#23 2016-06-18 13:42:55

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:

However, now that you have copied the "workstation" example to /etc/nftables.conf the `systemctl start nftables` command should now work if you try it again

I ran this command after boot...

hugh@ASUS-BUNSENLABS:~$ sudo systemctl start nftables
[sudo] password for hugh: 
Job for nftables.service failed. See 'systemctl status nftables.service' and 'journalctl -xn' for details.
hugh@ASUS-BUNSENLABS:~$

... but still getting failed message

Remember to `enable` it to start automatically.

So I will add the command 'sudo systemctl start nftables' to end of '.config/openbox/autostart' followed by '&' ?

Check for all enabled .services (& .targets & .sockets) with:

systemctl list-unit-files | grep enabled

I ran this command and here is output....

hugh@ASUS-BUNSENLABS:~$ systemctl list-unit-files | grep enabled
cups.path                                  enabled 
anacron-resume.service                     enabled 
anacron.service                            enabled 
avahi-daemon.service                       enabled 
cron.service                               enabled 
cups-browsed.service                       enabled 
cups.service                               enabled 
dbus-org.freedesktop.Avahi.service         enabled 
dbus-org.freedesktop.ModemManager1.service enabled 
dbus-org.freedesktop.nm-dispatcher.service enabled 
display-manager.service                    enabled 
getty@.service                             enabled 
hwclock-save.service                       enabled 
lightdm.service                            enabled 
lm-sensors.service                         enabled 
ModemManager.service                       enabled 
NetworkManager-dispatcher.service          enabled 
NetworkManager.service                     enabled 
rsyslog.service                            enabled 
smartd.service                             enabled 
ssh.service                                enabled 
sshd.service                               enabled 
syslog.service                             enabled 
avahi-daemon.socket                        enabled 
cups.socket                                enabled 
uuidd.socket                               enabled 
remote-fs.target                           enabled 
hugh@ASUS-BUNSENLABS:~$

Yes, sorry -- you can run `sudo nft list ruleset` after boot to see if the rules have been applied

I ran the command but there wan't any output, should this produce a list?

hugh@ASUS-BUNSENLABS:~$ sudo nft list ruleset
hugh@ASUS-BUNSENLABS:~$

...and you can use this command after boot to see if the .service has been started:

systemctl status nftables.service

I ran the 'status' command but got 'failed' resullt...

hugh@ASUS-BUNSENLABS:~$ systemctl status nftables.service
● nftables.service - nftables
   Loaded: loaded (/lib/systemd/system/nftables.service; disabled)
   Active: failed (Result: exit-code) since Sat 2016-06-18 13:59:59 BST; 3min 39s ago
     Docs: man:nft(8)
           http://wiki.nftables.org
  Process: 1433 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=1/FAILURE)
 Main PID: 1433 (code=exited, status=1/FAILURE)
hugh@ASUS-BUNSENLABS:~$

I tried running the command 'systemctl start nftables.service' but get failed message again...

hugh@ASUS-BUNSENLABS:~$ sudo systemctl start nftables.service
[sudo] password for hugh: 
Job for nftables.service failed. See 'systemctl status nftables.service' and 'journalctl -xn' for details.
hugh@ASUS-BUNSENLABS:~$

then I tried enable commande...

hugh@ASUS-BUNSENLABS:~$ sudo systemctl enable nftables.service
Created symlink from /etc/systemd/system/multi-user.target.wants/nftables.service to /lib/systemd/system/nftables.service.
hugh@ASUS-BUNSENLABS:~$

I don't think I'm getting very far, maybe it's too difficult for a newbie like myself. not sure what I'm doing wrong. But I do appreciate your help on this.  Does any of the above info help identify where I'm going wrong?

Offline

#24 2016-06-18 13:52:45

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:

Remember to `enable` it to start automatically.

So I will add the command 'sudo systemctl start nftables' to end of '.config/openbox/autostart' followed by '&' ?

No, don't do that.

You should just run `sudo systemctl enable nftables.service`

That should persist between reboots.

For now try this fix hack:

sudo sed -i 's/flush/#flush/' /etc/nftabes.conf

I will have to investigate this further and find a proper fix, thank you for reporting this smile

Last edited by Head_on_a_Stick (2016-06-18 13:53:28)

Para todos todo, para nosotros nada

Offline

#25 2016-06-18 14:07:01

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:

You should just run `sudo systemctl enable nftables.service`

That should persist between reboots.

For now try this fix hack:

sudo sed -i 's/flush/#flush/' /etc/nftabes.conf

I will have to investigate this further and find a proper fix, thank you for reporting this smile

Thanks for your quick feedback, I ran both commands as suggested.

Is it OK for me to run the command ..  

$ sudo systemctl start nftables

.. or will I wait?

Offline

#26 2016-06-18 14:07:47

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

The command should work now.

That hack shouldn't be needed though so I will have to see what's wrong.

Para todos todo, para nosotros nada

Offline

#27 2016-06-18 14:29:32

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:

The command should work now.

That hack shouldn't be needed though so I will have to see what's wrong.

I ran the command...

$ sudo systemctl start nftables
hugh@ASUS-BUNSENLABS:~$ sudo systemctl start nftables
hugh@ASUS-BUNSENLABS:~$

then I ran command to check if the rules have been applied

hugh@ASUS-BUNSENLABS:~$ sudo nft list ruleset
table inet filter {
	chain input {
		type filter hook input priority 0; policy accept;
		iif lo accept
		ct state established,related accept
		icmpv6 type { nd-router-advert, nd-neighbor-advert, nd-neighbor-solicit} accept
		counter packets 87 bytes 17016 drop
	}
}
hugh@ASUS-BUNSENLABS:~$

... this looks better, is this the expected output?

then I ran following command to check if the .service has been started

hugh@ASUS-BUNSENLABS:~$ systemctl status nftables.service
● nftables.service - nftables
   Loaded: loaded (/lib/systemd/system/nftables.service; enabled)
   Active: active (exited) since Sat 2016-06-18 15:09:41 BST; 5min ago
     Docs: man:nft(8)
           http://wiki.nftables.org
  Process: 1655 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=0/SUCCESS)
 Main PID: 1655 (code=exited, status=0/SUCCESS)
hugh@ASUS-BUNSENLABS:~$

... again this looks better than before, does it look ok?

So does the last two commands indicate that the firewall is up and running now ? 

Is that the configuration completed?

Offline

#28 2016-06-18 14:44:17

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:

So does the last two commands indicate that the firewall is up and running now ? 

Is that the configuration completed?

Yes, that all looks good to me smile

You now have a "whitelist" firewall that only accepts connections you have created yourself or those related directly to them.

The IPv6 lines may not be needed for your system, you can try editing the file directly to comment them out -- just be sure to backup the file first!

As I say, I will investigate why the `sed` hack was needed; a bug report may be required here.

Para todos todo, para nosotros nada

Offline

#29 2016-06-18 14:55:50

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Thanks for confirmation.

I'm not sure what to edit ref 'IPv6' (is it just a single line?) so I'll leave that if it's not doing any harm.

I have another old laptop (DELL Vostro 1520) with BunsenLabs on it, so later tonight I will use what I have learned and make up a list of the setup steps and checklist needed to set up the firewall and will let you know how I get on.

Once again many thanks for your patience, I do appreciate it.  The help on this forum is second to none, and BunsenLabs is an amazing distro. My 6 year old DELL Vostro is fitted with an SSD and boots up in 8 seconds and shuts down in 5 seconds. It's so fast now.

Last edited by Head_on_a_Stick (2016-06-18 15:01:57)

Offline

#30 2016-06-18 19:15:56

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

I thought I would try to repeat above steps on my DELL Vostro, the install seemed to go ok, but I didn't get very far after that ....

hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo apt-get install -t jessie-backports nftables
[sudo] password for hugh: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following extra packages will be installed:
  libjansson4 libmxml1 libnftnl4
The following NEW packages will be installed:
  libjansson4 libmxml1 libnftnl4 nftables
0 upgraded, 4 newly installed, 0 to remove and 105 not upgraded.
Need to get 252 kB of archives.
After this operation, 927 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://httpredir.debian.org/debian/ jessie/main libjansson4 amd64 2.7-1+deb8u1 [34.1 kB]
Get:2 http://httpredir.debian.org/debian/ jessie/main libmxml1 amd64 2.6-2 [28.0 kB]                         
Get:3 http://httpredir.debian.org/debian/ jessie-backports/main libnftnl4 amd64 1.0.6-1~bpo8+1 [62.2 kB]
Get:4 http://httpredir.debian.org/debian/ jessie-backports/main nftables amd64 0.5+snapshot20160426-1~bpo8+1 [128 kB]
Fetched 252 kB in 0s (274 kB/s)   
Selecting previously unselected package libjansson4:amd64.
(Reading database ... 102328 files and directories currently installed.)
Preparing to unpack .../libjansson4_2.7-1+deb8u1_amd64.deb ...
Unpacking libjansson4:amd64 (2.7-1+deb8u1) ...
Selecting previously unselected package libmxml1.
Preparing to unpack .../libmxml1_2.6-2_amd64.deb ...
Unpacking libmxml1 (2.6-2) ...
Selecting previously unselected package libnftnl4:amd64.
Preparing to unpack .../libnftnl4_1.0.6-1~bpo8+1_amd64.deb ...
Unpacking libnftnl4:amd64 (1.0.6-1~bpo8+1) ...
Selecting previously unselected package nftables.
Preparing to unpack .../nftables_0.5+snapshot20160426-1~bpo8+1_amd64.deb ...
Unpacking nftables (0.5+snapshot20160426-1~bpo8+1) ...
Processing triggers for man-db (2.7.0.2-5) ...
Setting up libjansson4:amd64 (2.7-1+deb8u1) ...
Setting up libmxml1 (2.6-2) ...
Setting up libnftnl4:amd64 (1.0.6-1~bpo8+1) ...
Setting up nftables (0.5+snapshot20160426-1~bpo8+1) ...
Processing triggers for libc-bin (2.19-18+deb8u4) ...
hugh@DELL-VOSTRO-BUNSENLABS:~$
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo cp /usr/share/doc/nftables/examples/syntax/workstation /etc/nftables.conf
hugh@DELL-VOSTRO-BUNSENLABS:~$
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo systemctl start nftables
Job for nftables.service failed. See 'systemctl status nftables.service' and 'journalctl -xn' for details.
hugh@DELL-VOSTRO-BUNSENLABS:~$ 
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo systemctl enable nftables.service
Created symlink from /etc/systemd/system/multi-user.target.wants/nftables.service to /lib/systemd/system/nftables.service.
hugh@DELL-VOSTRO-BUNSENLABS:~$
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo sed -i 's/flush/#flush/' /etc/nftabes.conf
sed: can't read /etc/nftabes.conf: No such file or directory
hugh@DELL-VOSTRO-BUNSENLABS:~$
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo systemctl start nftables
Job for nftables.service failed. See 'systemctl status nftables.service' and 'journalctl -xn' for details.
hugh@DELL-VOSTRO-BUNSENLABS:~$ 
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo systemctl enable nftables
hugh@DELL-VOSTRO-BUNSENLABS:~$ 
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo sed -i 's/flush/#flush/' /etc/nftabes.conf
sed: can't read /etc/nftabes.conf: No such file or directory
hugh@DELL-VOSTRO-BUNSENLABS:~$

Not sure where I went wrong, can you advise? Sorry for troubling you again but not sure what the sequence of events should now be.

Offline

#31 2016-06-18 19:23:27

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo sed -i 's/flush/#flush/' /etc/nftabes.conf
sed: can't read /etc/nftabes.conf: No such file or directory
hugh@DELL-VOSTRO-BUNSENLABS:~$

Typo -- you have put nftabes.conf, it should be nftables.conf

Let me check this on a live system...

EDIT: Reproduced in the live environment sad

I have updated the OP so that now lists all the required steps.

I must confess that I have no idea what is going on here, the Debian version of nftables won't accept `nft flush ruleset` as a command whereas this works just fine in my Arch system.

Last edited by Head_on_a_Stick (2016-06-18 19:32:39)

Para todos todo, para nosotros nada

Offline

#32 2016-06-18 19:48:24

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:
hughparker1 wrote:
hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo sed -i 's/flush/#flush/' /etc/nftabes.conf
sed: can't read /etc/nftabes.conf: No such file or directory
hugh@DELL-VOSTRO-BUNSENLABS:~$

Typo -- you have put nftabes.conf, it should be nftables.conf

Thanks for spotting that error.

Let me check this on a live system...

EDIT: Reproduced in the live environment sad

I have updated the OP so that now lists all the required steps.

I must confess that I have no idea what is going on here, the Debian version of nftables won't accept `nft flush ruleset` as a command whereas this works just fine in my Arch system.

I had a look at the OP and I see it now has four steps...
sudo apt-get install -t jessie-backports nftables
sudo cp /usr/share/doc/nftables/examples/syntax/workstation /etc/nftables.conf
sudo systemctl start nftables
sudo systemctl enable nftables

I get error when running 'sudo systemctl start nftables' should I run this first?

$ sudo sed -i 's/flush/#flush/' /etc/nftables.conf

Offline

#33 2016-06-18 19:49:32

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:

I had a look at the OP and I see it now has four steps...

Please look again, I think I was adding the fifth step while you posted wink

Sorry about all this, it's a bit of a mess  :8

Para todos todo, para nosotros nada

Offline

#34 2016-06-18 20:29:56

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:
hughparker1 wrote:

I had a look at the OP and I see it now has four steps...

Please look again, I think I was adding the fifth step while you posted wink

Sorry about all this, it's a bit of a mess  :8

Thanks very much for helping me on this, I'm not very technical, but with your help I think I've set it up ok on my Dell Vostro as well...

here are my steps...

1. $ sudo apt-get install -t jessie-backports nftables

2. $ sudo cp /usr/share/doc/nftables/examples/syntax/workstation /etc/nftables.conf
   
3. $ sudo sed -i 's/flush/#flush/' /etc/nftables.conf
   
4. $ sudo systemctl start nftables

5. $ sudo systemctl enable nftables   
   
Then I ran two checks...

6. $ sudo nft list ruleset    # check if the rules have been applied after boot

hugh@DELL-VOSTRO-BUNSENLABS:~$ sudo nft list ruleset
table inet filter {
	chain input {
		type filter hook input priority 0; policy accept;
		iif lo accept
		ct state established,related accept
		icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert} accept
		counter packets 137 bytes 26724 drop
	}
}
hugh@DELL-VOSTRO-BUNSENLABS:~$

looks OK?

7. $ systemctl status nftables.service         # check if the .service has been started 

hugh@DELL-VOSTRO-BUNSENLABS:~$ systemctl status nftables.service
● nftables.service - nftables
   Loaded: loaded (/lib/systemd/system/nftables.service; enabled)
   Active: active (exited) since Sat 2016-06-18 20:59:55 BST; 7min ago
     Docs: man:nft(8)
           http://wiki.nftables.org
 Main PID: 1312 (code=exited, status=0/SUCCESS)
hugh@DELL-VOSTRO-BUNSENLABS:~$

also looks OK?

I was wondering do I still need to run this command as well ...

  $ sudo systemctl enable nftables.service	## enable 'nftables.service' to start automatically

Offline

#35 2016-06-18 20:40:35

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

I just rebooted laptop and both checks output look same as above

6. $ sudo nft list ruleset			# check if the rules have been applied after boot
7. $ systemctl status nftables.service 		# check if the .service has been started

so maybe this command isn't necessary?

$ sudo systemctl enable nftables.service	## enable 'nftables.service' to start automatically

Offline

#36 2016-06-18 20:43:36

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:

so maybe this command isn't necessary?

$ sudo systemctl enable nftables.service	## enable 'nftables.service' to start automatically

It is only neccessary to run that command once and you already did that wink

As I said, use `systemctl list-unit-files | grep enabled` to check if it is enabled.

Para todos todo, para nosotros nada

Offline

#37 2016-06-18 20:51:31

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:
hughparker1 wrote:

so maybe this command isn't necessary?

$ sudo systemctl enable nftables.service	## enable 'nftables.service' to start automatically

It is only neccessary to run that command once and you already did that wink

you are right, I already ran this command earlier.

if I was doing this setup again, would I run this command after step 4. $ sudo systemctl start nftables
or after step 5?

As I said, use `systemctl list-unit-files | grep enabled` to check if it is enabled.

thanks I will use that for checking in future.

Offline

#38 2016-06-18 20:52:48

Head_on_a_Stick
Member
From: London
Registered: 2015-09-29
Posts: 9,093
Website

Re: Firewall for the lazy

hughparker1 wrote:

if I was doing this setup again, would I run this command after step 4. $ sudo systemctl start nftables
or after step 5?

For that particular command, the order doesn't really matter because it does not take effect until the next bootup.

Para todos todo, para nosotros nada

Offline

#39 2016-06-18 20:55:18

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Thanks for all your help. I am learning more each day with your great feedback.

Offline

#40 2016-06-18 21:13:16

hughparker1
Member
Registered: 2016-05-05
Posts: 51

Re: Firewall for the lazy

Head_on_a_Stick wrote:
hughparker1 wrote:

if I was doing this setup again, would I run this command after step 4. $ sudo systemctl start nftables
or after step 5?

For that particular command, the order doesn't really matter because it does not take effect until the next bootup.

Just one last question...
Do I need to run this command as part of a new setup of nftables?

$ sudo systemctl enable nftables.service	## enable 'nftables.service' to start automatically

If this step was missed would it cause a problem on reboot?

Last edited by hughparker1 (2016-06-18 21:15:09)

Offline

Pages: 1 2 3 4

  1. Index
  2. » Scripts, Tutorials & Tips
  3. » Firewall for the lazy

Board footer

Powered by FluxBB