iptables setup from perfsonar-toolkit-security not loaded on U24?

[laeti-tia]

Installing perfsonar-testpoint together with perfsonar-toolkit-security on Ubuntu 22 and 24 doesn't seem to result in anything existing neither in iptables nor in firewalld.

It might be related to #427

[laeti-tia]

Or this might be an artefact of running in a Docker container…

[laeti-tia]

Firewall setup is working on U22 on a VM, but is not working in a Docker container, which was my primary testing environment. Will test on U24 VM in a few days.

However it's good to know that on newer OS, the firewalld backend is not iptables anymore but nf_tables. If you want to double check the firewalld setup is correctly defined in the kernel filtering tables, you need to use nft based commands, for example:

# nft list chain inet firewalld filter_IN_public_allow
table inet firewalld {
	chain filter_IN_public_allow {
		tcp dport 22 ct state { new, untracked } accept
		ip6 daddr fe80::/64 udp dport 546 ct state { new, untracked } accept
		udp dport 123 ct state { new, untracked } accept
		udp dport 33434-33634 ct state { new, untracked } accept
		tcp dport 4823 ct state { new, untracked } accept
		tcp dport 861 ct state { new, untracked } accept
		tcp dport 862 ct state { new, untracked } accept
		tcp dport 80 ct state { new, untracked } accept
		tcp dport 443 ct state { new, untracked } accept
		udp dport 8760-9960 ct state { new, untracked } accept
		tcp dport 8760-9960 ct state { new, untracked } accept
		udp dport 18760-19960 ct state { new, untracked } accept
		tcp dport 18760-19960 ct state { new, untracked } accept
		tcp dport 5201 ct state { new, untracked } accept
		udp dport 5201 ct state { new, untracked } accept
		tcp dport 5001 ct state { new, untracked } accept
		udp dport 5001 ct state { new, untracked } accept
		tcp dport 5000 ct state { new, untracked } accept
		tcp dport 5101 ct state { new, untracked } accept
		udp dport 5000 ct state { new, untracked } accept
		udp dport 5101 ct state { new, untracked } accept
		tcp dport 5890-5900 ct state { new, untracked } accept
	}
}