Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback

2026-10-07 07:29:29 +00:00
parent 27e9d4a1ab
commit cfe87002c5
19 changed files with 417 additions and 227 deletions
@@ -0,0 +1,22 @@
+[Unit]
+Description=Host input firewall (nftables table inet host)
+# Same early-boot placement as nftables.service. Its "flush ruleset" on start,
+# reload and stop would wipe this table, so load after it and follow all three.
+DefaultDependencies=no
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+After=nftables.service
+PartOf=nftables.service
+ReloadPropagatedFrom=nftables.service
+Conflicts=shutdown.target
+ConditionPathExists=/etc/nftables.d/host.nft
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/host.nft
+ExecReload=/usr/sbin/nft -f /etc/nftables.d/host.nft
+ExecStop=-/usr/sbin/nft delete table inet host
+
+[Install]
+WantedBy=sysinit.target