This is likely a clue:
# iptables -nL ufw-track-input
iptables v1.8.7 (nf_tables): chain `ufw-track-input' in table `filter' is
incompatible, use 'nft' tool.
however `nft list ruleset` doesn't even mention `ufw-track-input`
anywhere in the output.
On this machine iptables-persistent and netfilter-persistent had been
installed when Puppet went ahead and installed ufw alongside them. When
I looked t /etc/iptables/rules.* files, I saw a snapshot of ufw-created
rules. Something about the way iptables-persistent loadeds those rules
must've made ufw unable to deal with them, leaving the running system in
this state.
I'm now pretty sure the problem will go away if I reboot or completely
flush the nftables ruleset. And it did: when I ran `nft flush ruleset`
and then tried `/lib/ufw/ufw-init restart` again, there were no more
errors from iptables-restore, and iptables -nL shows all the rules I
expect.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171087
Title:
`ufw enable` sets policy but doesn't add any rules, fails with "ERROR:
problem running ufw-init", leaves machine unreachable over SSH
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ufw/+bug/2171087/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
