Je viens de passer de iptables à nftables mais j'ai un doute sur son fonctionnement :
Code : Tout sélectionner
~# systemctl status nftables.service
● nftables.service - nftables
Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor preset: e>
Active: active (exited) since Fri 2023-09-01 19:54:05 CEST; 4min 59s ago
Docs: man:nft(8)
http://wiki.nftables.org
Process: 238 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=>
Main PID: 238 (code=exited, status=0/SUCCESS)
CPU: 14ms
Warning: journal has been rotated since unit was started, output may be incomplete.
:~# systemctl status nftables
● nftables.service - nftables
Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor preset: e>
Active: active (exited) since Fri 2023-09-01 19:54:05 CEST; 8min ago
Docs: man:nft(8)
http://wiki.nftables.org
Process: 238 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=>
Main PID: 238 (code=exited, status=0/SUCCESS)
CPU: 14ms
Warning: journal has been rotated since unit was started, output may be incomplete.
Code : Tout sélectionner
~# cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept
ct state established,related accept
tcp dport 631 accept
}
chain forward {
type filter hook forward priority filter; policy drop;
}
chain output {
type filter hook output priority filter; policy accept;
}
}
- je viens de vérifier la sortie de pstree et je ne vois aucun processus pouvant être associé à nftables ; idem avec ps x pas de n° 238 . On dirait qu'il y a eu un démarrage et un arrêt de ce processus , non ?
- voici ce qu'en dit le site stackexchange :
State active (exited) means that systemd has successfully run the commands but that it does not know there is a daemon to monitor.
If there is you must define it in the unit file by configuring the Type and ExecStart options appropriately according to whether the process you start is the main proces, forks child processes and exits etc.
mais ça ne me parle pas du tout du tout
- ça c'est déjà mieux , mais comment en décider ?
active (exited) is not a problem in itself. For example, if the unit file sets RemainAfterExit=true, a service that exits is reported as active. Example: On my Ubuntu server, the ufw service initializes the firewall at system startup. It's a oneshot service, which performs one task then exits. However, it's still considered active, perhaps because inactive would confuse users. After all, the firewall is in place.
