Skip to content

Commit

Permalink
[Update] Set iptables-legacy as alternative on Debian systems
Browse files Browse the repository at this point in the history
  • Loading branch information
@andryyy
andryyy committed Apr 7, 2021
1 parent 339c8a4 commit af14907
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions update.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,11 @@ while read NAT_ID; do
iptables -t nat -D POSTROUTING $NAT_ID
done < <(iptables -L -vn -t nat --line-numbers | grep $IPV4_NETWORK | grep -E 'MASQUERADE.*all' | grep -v ${MAILCOW_BRIDGE} | cut -d' ' -f1)

echo -e "\e[32mChecking for iptables-legacy...\e[0m"
if update-alternatives --list iptables 2> /dev/null | grep -q /usr/sbin/iptables-legacy; then
update-alternatives --set iptables /usr/sbin/iptables-legacy
fi

DIFF_DIRECTORY=update_diffs
DIFF_FILE=${DIFF_DIRECTORY}/diff_before_update_$(date +"%Y-%m-%d-%H-%M-%S")
mv diff_before_update* ${DIFF_DIRECTORY}/ 2> /dev/null
Expand Down

17 comments on commit af14907

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why this change? What advantages/disadvantages will this bring?

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Furthermore, should not ip6tables then also be changed here?

@mkuron
Copy link
Member

@mkuron mkuron commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this is about that problem where ipv6nat does not start when Docker‘s rules were created with a certain version of iptables-nft (#3940)? If that‘s the case, we should probably restrict this to that specific version.

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I think this command need the be improved.

@andryyy
Copy link
Contributor Author

@andryyy andryyy commented on af14907 Apr 7, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm. I came across problems on Buster lately.

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the problem currently only affect Buster? Maybe you could limit it somehow.

But you already know what you are doing :)

And I think you missed ip6tables:
af14907#commitcomment-49196793

@mkuron
Copy link
Member

@mkuron mkuron commented on af14907 Apr 7, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm. I came across problems on Buster lately.

I expect that you'd get it when you install iptables 1.8.5 from backports on buster. A vanilla buster should not exhibit the issue as it has iptables 1.8.2. Bullseye has iptables 1.8.7, which robbertkl/docker-ipv6nat#67 says is the version with the fix.

So how about checking for iptables 1.8.[456], running update-alternatives on Debian and printing an error messages on other distributions?

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting update-alternatives on effected versions and on other doing nothing as before :)

@paftek
Copy link

@paftek paftek commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have updated Mailcow this morning and this change breaks my installation:

ERROR: Failed to Setup IP tables: Unable to enable SKIP DNAT rule:  (COMMAND_FAILED: '/usr/sbin/iptables -w10 -t nat -I DOCKER -i br-mailcow -j RETURN' failed: iptables: No chain/target/match by that name.)

My system:

  • OS: Buster
  • iptables: 1.8.5 from backports (1.8.5-3~bpo10+1)
  • iptables alternatives: /usr/sbin/iptables-legacy, /usr/sbin/iptables-nft

I temporary solved the issue by removing the "/usr/sbin/iptables-legacy" alternative and updating again.

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was aware that there will be problems here (@andryyy).

@paftek
How exactly did you go about removing it temporarily?

@paftek
Copy link

@paftek paftek commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@omexlu:

  • I removed the problematic alternative: update-alternatives --remove iptables /usr/sbin/iptables-legacy
  • Ran update.sh
  • And set the alternative back: update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables-legacy 10

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 7, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, it has been reverted:
d71ce15

@Daniel15
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will mailcow be upgraded to use nftables in the future? iptables is legacy now and the compatibility shim won't be around forever.

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nfttables is not already on all systems ':)

@Daniel15
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nfttables is not already on all systems ':)

@omexlu That's true, however eventually all Linux distros will migrate across to nftables and the legacy iptables interfaces will be removed, so it's a reasonable idea to detect the presence of nftables and prefer its commands when available.

The same thing happened when iptables was new. Some people stuck to the old implementation (ipchains) for a while, but eventually everyone migrated across and the old one was removed, and now nobody ever talks about ipchains any more :)

@omexlu
Copy link

@omexlu omexlu commented on af14907 Apr 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes you right, I am sure this will be implemented with a detect what is available :)

@andryyy
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just wait. No need to act now at all.

Please sign in to comment.