All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jan Engelhardt <ej@inai.de>
Cc: Phil Sutter <phil@nwl.cc>, Dan Winship <danwinship@redhat.com>,
	Eric Garver <eric@garver.life>, Jan Engelhardt <jengelh@inai.de>,
	netfilter-devel@vger.kernel.org, fw@strlen.de,
	Kevin Fenzi <kevin@scrye.com>,
	Matthias Gerstner <matthias.gerstner@suse.com>,
	arturo@debian.org
Subject: Re: [PATCH] tools: add a systemd unit for static rulesets
Date: Thu, 17 Apr 2025 14:39:48 +0200	[thread overview]
Message-ID: <aAD2lOV4FBvA_oKx@calendula> (raw)
In-Reply-To: <s0r11o2s-35ns-4sp9-1s0p-6n7n5r743581@vanv.qr>

Hi Jan,

On Wed, Mar 26, 2025 at 11:21:09PM +0100, Jan Engelhardt wrote:
> 
> On Wednesday 2025-03-26 16:56, Phil Sutter wrote:
> >
> >The suggested 'flush ruleset' stems from Fedora's nftables.service and
> >is also present in CentOS Stream and RHEL. So anyone running k8s there
> >either doesn't use nftables.service (likely, firewalld is default) or
> >doesn't restart the service. Maybe k8s should "officially" conflict with
> >nftables and iptables services?
> 
> It definitely should.
> 
> For example, in openSUSE we already added an extra constraint between
> firewalld <-> nftables, so k8s should likely get a similar treatment.
> 
> fail2ban is also interesting, but a solved problem
> (equally added ordering constraints to the distro years ago).

I think this still needs one more iteration based on the feedback,
Phil mentioned one issue with flush ruleset that I can remember.

Thanks.

  reply	other threads:[~2025-04-17 12:39 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-28 20:59 [PATCH] tools: add a systemd unit for static rulesets Jan Engelhardt
2025-03-05 21:35 ` Pablo Neira Ayuso
2025-03-21 13:29   ` Arturo Borrero Gonzalez
2025-03-22  1:49     ` Duncan Roe
2025-03-22  9:24       ` Jan Engelhardt
2025-03-23 10:00         ` Arturo Borrero Gonzalez
2025-03-23 13:34           ` Jan Engelhardt
2025-03-23 21:04             ` Phil Sutter
2025-03-23 10:24     ` Pablo Neira Ayuso
2025-03-06 14:16 ` Eric Garver
2025-03-20 14:05   ` Phil Sutter
2025-03-22  9:46     ` Jan Engelhardt
2025-03-25  1:34     ` Dan Winship
2025-03-26 15:56       ` Phil Sutter
2025-03-26 22:21         ` Jan Engelhardt
2025-04-17 12:39           ` Pablo Neira Ayuso [this message]
2025-03-27 11:12         ` Dan Winship
2025-03-27 13:29           ` Phil Sutter
2025-03-22  9:41   ` Jan Engelhardt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aAD2lOV4FBvA_oKx@calendula \
    --to=pablo@netfilter.org \
    --cc=arturo@debian.org \
    --cc=danwinship@redhat.com \
    --cc=ej@inai.de \
    --cc=eric@garver.life \
    --cc=fw@strlen.de \
    --cc=jengelh@inai.de \
    --cc=kevin@scrye.com \
    --cc=matthias.gerstner@suse.com \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=phil@nwl.cc \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.