hi folks
I am testing migration of firewall from iptables to nftables
my versions
* pve-manager/7.4-16/0f39f621 (running kernel: 5.15.108-1-pve)
* iptables 1.8.7-1
* nftables 0.9.8-3.1+deb11u1
# nft -V
nftables v0.9.8 (E.D.S.)
cli: editline
json: yes
minigmp: no
libxtables: yes
I've already translated rulesets from iptables to nftables
and want to deploy them at pve-firewall
PLS can anybody let me know the configuration of pve-firewall.service
for nft ?
current for iptables
# cat /lib/systemd/system/pve-firewall.service
[Unit]
Description=Proxmox VE firewall
ConditionPathExists=/usr/sbin/pve-firewall
Wants=pve-cluster.service pvefw-logger.service
After=pvefw-logger.service pve-cluster.service network.target
systemd-modules-load.service
DefaultDependencies=no
Before=shutdown.target
Conflicts=shutdown.target
[Service]
ExecStartPre=-/usr/bin/update-alternatives --set ebtables
/usr/sbin/ebtables-legacy
ExecStartPre=-/usr/bin/update-alternatives --set iptables
/usr/sbin/iptables-legacy
ExecStartPre=-/usr/bin/update-alternatives --set ip6tables
/usr/sbin/ip6tables-legacy
ExecStart=/usr/sbin/pve-firewall start
ExecStop=/usr/sbin/pve-firewall stop
ExecReload=/usr/sbin/pve-firewall restart
PIDFile=/run/pve-firewall.pid
Type=forking
[Install]
WantedBy=multi-user.target
thank you
NadaMac
_______________________________________________
pve-user mailing list
[email protected]
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-user
