I recently changed from Debian 7 to 8 which now uses systemd as the default init.
I had a init file that worked fine (see below) and works fine when directly invoked
Code:
$ sudo /etc/init.d/iptables start
however fails when indirectly invoked
Code:
$ sudo service iptables start
Job for iptables.service failed. See 'systemctl status iptables.service' and 'journalctl -xn' for details.
Code:
$ systemctl status iptables.service
iptables.service - LSB: Iptable setup
Loaded: loaded (/etc/init.d/iptables)
Active: failed (Result: exit-code) since Mon 2015-05-25 17:18:37 PDT; 5s ago
Process: 4825 ExecStart=/etc/init.d/iptables start (code=exited, status=203/EXEC)
Code:
$ journalctl -xn
No journal files were found.
I don't understand the error except that it "failed" and is loaded.
I have disabled and re-enabled the service with these commands:
Code:
sudo systemctl disable iptables
sudo systemctl enable iptables
which completes successfully but did not fix the problem.
INIT file
Code:
### BEGIN INIT INFO
# Provides: iptables
# Required-Start: $network $remote_fs $syslog
# Required-Stop: $network $remote_fs $syslog
# Should-Start: $portmap
# Should-Stop: $portmap
# X-Start-Befo nis
# X-Stop-After: nis
# Default-Start: 2
# Default-Stop: 1
# X-Interactive: false
# Short-Description: Iptable setup
# Description: Sets iptable rules
#
### END INIT INFO
ipt=/sbin/iptables
loadrules() {
if [ -e /etc/iptables_ruleset ]; then iptables-restore < /etc/iptables_ruleset && exit 0; fi
$ipt -F
$ipt -X
# Policies and Chains
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -N SSH
$ipt -N WEBSERVER
$ipt -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$ipt -A INPUT -i lo -j ACCEPT # Allow loopback
# Services
$ipt -A INPUT -p tcp -m multiport --dport 443,80 -j WEBSERVER # WEBSERVER chain
$ipt -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j SSH # Jump to SSH chain
$ipt -A INPUT -p tcp -s 192.168.1.1/24 --dport 445 -j ACCEPT # samba
# Reject message for LAN
$ipt -A INPUT -s 192.168.1.1/24 -j REJECT
# WEBSERVER chain
$ipt -A WEBSERVER -p tcp -m multiport --dport 443,80 -m conntrack --ctstate NEW -j LOG
$ipt -A WEBSERVER -p tcp -m multiport --dport 443,80 -j ACCEPT
# SSH chain
$ipt -A SSH -p tcp --dport 22 -m recent --set --name SSH # Set SSH recent
$ipt -A SSH -p tcp --dport 22 -m recent --name SSH --update --seconds 10 --hitcount 2 --rttl -j LOG # Log if over counter
$ipt -A SSH -p tcp --dport 22 -s 192.168.1.1/24 -m recent --name SSH --update --seconds 10 --hitcount 10 --rttl -j REJECT # Reject from lan if over counter
$ipt -A SSH -p tcp --dport 22 ! -s 192.168.1.1/24 -m recent --name SSH --update --seconds 10 --hitcount 2 --rttl -j DROP # Drop if over counter
$ipt -A SSH -p tcp --dport 22 -j ACCEPT
iptables-save > /etc/iptables_ruleset
}
removerules() {
$ipt -P INPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -F
$ipt -X
}
restartrules() {
rm /etc/iptables_ruleset
loadrules
}
case "$1" in
start)
loadrules
;;
stop)
removerules
;;
restart)
restartrules
;;
*)
echo "Usage: $0 start|stop|restart" >&2
exit 3
;;
esac
Edit:
Checking /var/log/daemon.log gives me this info:
Code:
May 25 19:13:29 hostname systemd[6004]: Failed at step EXEC spawning /etc/init.d/iptables: Exec format error
May 25 19:13:29 hostname systemd[1]: iptables.service: control process exited, code=exited status=203
May 25 19:13:29 hostname systemd[1]: Failed to start LSB: Iptable setup.
May 25 19:13:29 hostname systemd[1]: Unit iptables.service entered failed state.