/etc/network/if-up.d/iptables script won't work!

Hi guys,
I’ve followed this guide in order to save and restore my iptables roules but even if the iptables script is called at boot… it wan’t restore my iptables!
https://www.debian-administration.org/article/445/Getting_IPTables_to_survive_a_reboot

I’ve checket manualy the script (sudo /etc/network/if-up.d/iptables) and it works and I’ve also put this line at the end of the script: “touch /var/log/hello.log” and it succesfully create the file so the script is called at boot… any idea?

PS: dmsg is empy… have I to enable something to make OSMC log stuffs? Where I can check system log?

Thanks!

sudo journalctl

Thanks Katze!
I’ve just take a look in the log and I found:


Nov 03 10:18:09 osmc net.agent[181]: ERROR: /sbin/ifup not found. You need to install the ifupdown package.
Nov 03 10:18:09 osmc net.agent[183]: net.agent add event for eth0 not handled.

Could be this my problem/ If yes… Why?

I’m afraid /etc/network/if-up.d/ scripts are not currently supported in OSMC, so you will not be able to get any script that is intended to be run from there working.

It’s something on our longer term todo list but it requires some custom patching of connman as connman does not support if-up.d scripts.

I’m reinstalling OSMC and all my stuff to a big microSD and I’m sure I saw the same script working on the old instalaltion (small microSD).

I’m still reading the logger and I also found:

net.agent[292]: ERROR: /sbin/ifup not found. You need to install the ifupdown package.

Maybe, installing ifupdown will solve my problem and for some reason on the old installation there was?

Trust me, it is not supported. :wink:

The ifupdown package is missing which would provide you /sbin/ifup if you install it, however this will not solve your issue, because connman does not call any if-up.d scripts when interfaces go up.

Thanks for clarification!
Maybe I had too many beer when I saw it works on the past installation! :smile:

Anyway… could be better in any case to install ifupdown package ?
How to solve my problem of restoring iptables?
Is rc.local my friend or have I to wait for the ifup in the next release/update?

As I’ve explained, we don’t currently offer if-up.d support, so if you need a script that is run every time a network interface comes up, you are out of luck.

I’ve just install ifupdown and… everythink works fine! :wink:

I don’t understand why you’re so sceptical of everything I say ?

If you install the ifupdown package your script will run once, during early boot for the loopback interface (lo) before Ethernet even comes up. This is because systemd handles bringing up the loopback interface itself. (Check the IFACE environment variable in your script if you don’t believe me - it will say ‘lo’)

However it will not run when Ethernet comes up, (which occurs later in boot, and is brought up by connman) nor will it run again if the network interface goes down and comes back up again.

What you have done is not really any different than running your script from rc.local - it runs once during boot and that is all.

Completely useless for properly applying firewall rules, which must be reapplied every time an interface goes down and comes back up. (Particularly in the case of a Wireless adaptor where the interface is completely removed from the kernel if you unplug the adaptor)

You can believe what you want but I can categorically state (as one of the OSMC developers who has been working on this feature) that if-up.d support is not working in OSMC at the moment. Running a script once at boot time for the loopback inteface does not count as working if-up.d support. :wink:

Apology DBMandrake, I really don’t want to be sceptical of everything you say!
I’ve really appreciate you help and I’ve just tryed to install ifupdown package because it was suggested on the log.
Your explanation about applying firewall rules every time an interface goes down and comes back up it’s correct but at the moment I think we have no choice if if-up.d support is not working in OSMC.
Putting the script on rc.local or on if-up.d at the moment will produce the same result if I’ve understood well with the only difference that putting the script on the if-up.d make my system just ready for when it will supported.
I’m I worng/? Should I put on rc.local in your opinion?

Sorry again if I hurt you in any way.
Marco