diff -Nru iptables-persistent-1.0.14/debian/changelog iptables-persistent-1.0.14ubuntu1/debian/changelog --- iptables-persistent-1.0.14/debian/changelog 2019-09-13 14:16:28.000000000 -0300 +++ iptables-persistent-1.0.14ubuntu1/debian/changelog 2021-12-10 09:55:20.000000000 -0300 @@ -1,3 +1,16 @@ +iptables-persistent (1.0.14ubuntu1) focal; urgency=medium + + [ Mauricio Faria de Oliveira ] + * [36cf9e] Introduce options IP[6]TABLES_RESTORE_NOFLUSH + Thanks to Mauricio Faria de Oliveira (Closes: #998416). + + [ Jorge Merlino ] + * plugins/{15-ip4tables,25-ip6tables}: Add configuration options to use + ip[6]tables --noflush so that existing rules are not flushed on + start/load (closes LP: #1949643) + + -- Jorge Merlino Fri, 10 Dec 2021 09:55:20 -0300 + iptables-persistent (1.0.14) unstable; urgency=medium * [401a9f] No longer load modules. diff -Nru iptables-persistent-1.0.14/debian/netfilter-persistent.default iptables-persistent-1.0.14ubuntu1/debian/netfilter-persistent.default --- iptables-persistent-1.0.14/debian/netfilter-persistent.default 2019-09-13 14:16:28.000000000 -0300 +++ iptables-persistent-1.0.14ubuntu1/debian/netfilter-persistent.default 2021-12-10 09:55:20.000000000 -0300 @@ -8,3 +8,9 @@ # IPTABLES_SKIP_SAVE=yes # IP6TABLES_SKIP_SAVE=yes # IPSET_SKIP_SAVE=yes + + +# Set to yes for not flushing existing ip[6]tables rules when netfilter-persistent +# is called with the start parameter +# IPTABLES_RESTORE_NOFLUSH=yes +# IP6TABLES_RESTORE_NOFLUSH=yes diff -Nru iptables-persistent-1.0.14/plugins/15-ip4tables iptables-persistent-1.0.14ubuntu1/plugins/15-ip4tables --- iptables-persistent-1.0.14/plugins/15-ip4tables 2019-09-13 14:16:28.000000000 -0300 +++ iptables-persistent-1.0.14ubuntu1/plugins/15-ip4tables 2021-12-10 09:55:20.000000000 -0300 @@ -21,11 +21,17 @@ load_rules() { + if [ "${IPTABLES_RESTORE_NOFLUSH}x" = "yesx" ]; then + NOFLUSH='--noflush' + else + NOFLUSH='' + fi + #load IPv4 rules if [ ! -f /etc/iptables/rules.v4 ]; then echo "Warning: skipping IPv4 (no rules to load)" else - iptables-restore < /etc/iptables/rules.v4 + iptables-restore $NOFLUSH < /etc/iptables/rules.v4 fi } diff -Nru iptables-persistent-1.0.14/plugins/25-ip6tables iptables-persistent-1.0.14ubuntu1/plugins/25-ip6tables --- iptables-persistent-1.0.14/plugins/25-ip6tables 2019-09-13 14:16:28.000000000 -0300 +++ iptables-persistent-1.0.14ubuntu1/plugins/25-ip6tables 2021-12-10 09:55:20.000000000 -0300 @@ -17,19 +17,30 @@ # Exit fast if IPv6 is disabled test -e /proc/sys/net/ipv6 || exit 0 +# Source configuration +if [ -f "/etc/default/netfilter-persistent" ]; then + . /etc/default/netfilter-persistent +fi + load_rules() { + if [ "${IP6TABLES_RESTORE_NOFLUSH}x" = "yesx" ]; then + NOFLUSH='--noflush' + else + NOFLUSH='' + fi + #load IPv6 rules if [ ! -f /etc/iptables/rules.v6 ]; then echo "Warning: skipping IPv6 (no rules to load)" else - ip6tables-restore < /etc/iptables/rules.v6 + ip6tables-restore $NOFLUSH < /etc/iptables/rules.v6 fi } save_rules() { - if [ ! "${IPTABLES_SKIP_SAVE}x" = "yesx" ]; then + if [ ! "${IP6TABLES_SKIP_SAVE}x" = "yesx" ]; then touch /etc/iptables/rules.v6 ip6tables-save > /etc/iptables/rules.v6 chmod 0640 /etc/iptables/rules.v6