diff -Nru iptables-persistent-1.0.15/debian/changelog iptables-persistent-1.0.15ubuntu1/debian/changelog --- iptables-persistent-1.0.15/debian/changelog 2021-02-14 04:49:44.000000000 -0300 +++ iptables-persistent-1.0.15ubuntu1/debian/changelog 2021-12-10 09:49:39.000000000 -0300 @@ -1,3 +1,12 @@ +iptables-persistent (1.0.15ubuntu1) hirsute; urgency=medium + + * Add configuration options IP[6]TABLES_RESTORE_NOFLUSH so that + existing rules are not flushed on start/load (LP: #1949643) + - debian/netfilter-persistent.default: Introduce options + - plugins/{15-ip4tables,25-ip6tables}: Check/apply options + + -- Jorge Merlino Fri, 10 Dec 2021 09:49:39 -0300 + iptables-persistent (1.0.15) unstable; urgency=medium * [b89d12] Fix warning message on the ipset plugin diff -Nru iptables-persistent-1.0.15/debian/netfilter-persistent.default iptables-persistent-1.0.15ubuntu1/debian/netfilter-persistent.default --- iptables-persistent-1.0.15/debian/netfilter-persistent.default 2021-02-14 04:27:46.000000000 -0300 +++ iptables-persistent-1.0.15ubuntu1/debian/netfilter-persistent.default 2021-12-10 09:49:39.000000000 -0300 @@ -8,3 +8,9 @@ # IPTABLES_SKIP_SAVE=yes # IP6TABLES_SKIP_SAVE=yes # IPSET_SKIP_SAVE=yes + + +# Set to yes for not flushing existing ip[6]tables rules when netfilter-persistent +# is called with the start parameter +# IPTABLES_RESTORE_NOFLUSH=yes +# IP6TABLES_RESTORE_NOFLUSH=yes diff -Nru iptables-persistent-1.0.15/plugins/15-ip4tables iptables-persistent-1.0.15ubuntu1/plugins/15-ip4tables --- iptables-persistent-1.0.15/plugins/15-ip4tables 2021-02-14 04:27:46.000000000 -0300 +++ iptables-persistent-1.0.15ubuntu1/plugins/15-ip4tables 2021-12-10 09:49:39.000000000 -0300 @@ -21,11 +21,17 @@ load_rules() { + if [ "${IPTABLES_RESTORE_NOFLUSH}x" = "yesx" ]; then + NOFLUSH='--noflush' + else + NOFLUSH='' + fi + #load IPv4 rules if [ ! -f /etc/iptables/rules.v4 ]; then echo "Warning: skipping IPv4 (no rules to load)" else - iptables-restore < /etc/iptables/rules.v4 + iptables-restore $NOFLUSH < /etc/iptables/rules.v4 fi } diff -Nru iptables-persistent-1.0.15/plugins/25-ip6tables iptables-persistent-1.0.15ubuntu1/plugins/25-ip6tables --- iptables-persistent-1.0.15/plugins/25-ip6tables 2021-02-14 04:27:46.000000000 -0300 +++ iptables-persistent-1.0.15ubuntu1/plugins/25-ip6tables 2021-12-10 09:49:39.000000000 -0300 @@ -17,19 +17,30 @@ # Exit fast if IPv6 is disabled test -e /proc/sys/net/ipv6 || exit 0 +# Source configuration +if [ -f "/etc/default/netfilter-persistent" ]; then + . /etc/default/netfilter-persistent +fi + load_rules() { + if [ "${IP6TABLES_RESTORE_NOFLUSH}x" = "yesx" ]; then + NOFLUSH='--noflush' + else + NOFLUSH='' + fi + #load IPv6 rules if [ ! -f /etc/iptables/rules.v6 ]; then echo "Warning: skipping IPv6 (no rules to load)" else - ip6tables-restore < /etc/iptables/rules.v6 + ip6tables-restore $NOFLUSH < /etc/iptables/rules.v6 fi } save_rules() { - if [ ! "${IPTABLES_SKIP_SAVE}x" = "yesx" ]; then + if [ ! "${IP6TABLES_SKIP_SAVE}x" = "yesx" ]; then touch /etc/iptables/rules.v6 ip6tables-save > /etc/iptables/rules.v6 chmod 0640 /etc/iptables/rules.v6