diff -Nru iptables-persistent-1.0.15/debian/changelog iptables-persistent-1.0.16/debian/changelog --- iptables-persistent-1.0.15/debian/changelog 2021-02-14 04:49:44.000000000 -0300 +++ iptables-persistent-1.0.16/debian/changelog 2021-11-03 17:54:29.000000000 -0300 @@ -1,3 +1,13 @@ +iptables-persistent (1.0.16) UNRELEASED; urgency=medium + + * Introduce options for ip[6]tables-restore --noflush: (Closes: #998416) + - d/netfilter-persistent.default: introduce IP[6]TABLES_RESTORE_NOFLUSH. + - p/15-ip4tables: check IPTABLES_RESTORE_NOFLUSH. + - p/25-ip6tables: check IP6TABLES_RESTORE_NOFLUSH; source config file; + (check the right variable: IP*6*TABLES_SKIP_SAVE while still there.) + + -- Mauricio Faria de Oliveira Wed, 03 Nov 2021 17:54:29 -0300 + iptables-persistent (1.0.15) unstable; urgency=medium * [b89d12] Fix warning message on the ipset plugin diff -Nru iptables-persistent-1.0.15/debian/netfilter-persistent.default iptables-persistent-1.0.16/debian/netfilter-persistent.default --- iptables-persistent-1.0.15/debian/netfilter-persistent.default 2021-02-14 04:27:46.000000000 -0300 +++ iptables-persistent-1.0.16/debian/netfilter-persistent.default 2021-11-03 17:32:32.000000000 -0300 @@ -8,3 +8,9 @@ # IPTABLES_SKIP_SAVE=yes # IP6TABLES_SKIP_SAVE=yes # IPSET_SKIP_SAVE=yes + + +# Set to yes for not flushing existing ip[6]tables rules when netfilter-persistent +# is called with the start parameter +# IPTABLES_RESTORE_NOFLUSH=yes +# IP6TABLES_RESTORE_NOFLUSH=yes diff -Nru iptables-persistent-1.0.15/plugins/15-ip4tables iptables-persistent-1.0.16/plugins/15-ip4tables --- iptables-persistent-1.0.15/plugins/15-ip4tables 2021-02-14 04:27:46.000000000 -0300 +++ iptables-persistent-1.0.16/plugins/15-ip4tables 2021-11-03 17:27:54.000000000 -0300 @@ -21,11 +21,17 @@ load_rules() { + if [ "${IPTABLES_RESTORE_NOFLUSH}x" = "yesx" ]; then + NOFLUSH='--noflush' + else + NOFLUSH='' + fi + #load IPv4 rules if [ ! -f /etc/iptables/rules.v4 ]; then echo "Warning: skipping IPv4 (no rules to load)" else - iptables-restore < /etc/iptables/rules.v4 + iptables-restore $NOFLUSH < /etc/iptables/rules.v4 fi } diff -Nru iptables-persistent-1.0.15/plugins/25-ip6tables iptables-persistent-1.0.16/plugins/25-ip6tables --- iptables-persistent-1.0.15/plugins/25-ip6tables 2021-02-14 04:27:46.000000000 -0300 +++ iptables-persistent-1.0.16/plugins/25-ip6tables 2021-11-03 17:29:14.000000000 -0300 @@ -17,19 +17,30 @@ # Exit fast if IPv6 is disabled test -e /proc/sys/net/ipv6 || exit 0 +# Source configuration +if [ -f "/etc/default/netfilter-persistent" ]; then + . /etc/default/netfilter-persistent +fi + load_rules() { + if [ "${IP6TABLES_RESTORE_NOFLUSH}x" = "yesx" ]; then + NOFLUSH='--noflush' + else + NOFLUSH='' + fi + #load IPv6 rules if [ ! -f /etc/iptables/rules.v6 ]; then echo "Warning: skipping IPv6 (no rules to load)" else - ip6tables-restore < /etc/iptables/rules.v6 + ip6tables-restore $NOFLUSH < /etc/iptables/rules.v6 fi } save_rules() { - if [ ! "${IPTABLES_SKIP_SAVE}x" = "yesx" ]; then + if [ ! "${IP6TABLES_SKIP_SAVE}x" = "yesx" ]; then touch /etc/iptables/rules.v6 ip6tables-save > /etc/iptables/rules.v6 chmod 0640 /etc/iptables/rules.v6