/etc/sysconfig/nftables.conf no longer loading at startup?
Ticket 95901850 describes the full background of this issue...
Briefly: on AlmaLinux 9, the Host Access Control entry chain was evaporating after every reboot, if it had been setup by manual nft commands outside the WHM Host Access Control screen (due to the inability of that screen to add and reorder rules without retyping the whole set). Furthermore, the reboot would also remove the entry on the input chain that passed every connection attempt through that firewall chain (probably because the firewall chain was not present at boot time).
The solution ultimately arrived at was to store both a correct input chain and a host entry firewall chain into the file /etc/sysconfig/nftables.conf (which, in my case, didn't previously exist, meaning there was no worry about overwriting important contents), so it would be loaded by the system on startup and therefore persist across reboots.
This worked fine for the past four months. Suddenly, my host access control firewall was gone again. The file /etc/sysconfig/nftables.conf still exists, with the proper contents. I am forced to assume that some recent system change is causing it to no longer be loaded at boot time. Has this mechanism changed?
Details: after a system upgrade, I do a graceful reboot of the machine as requested via automatic email from cPanel. Host Access Control shows up empty.
systemctl status nftables.service reports the service failed to start up:

And sure enough, there is next to nothing in the nft ruleset:

Clearly the contents of /etc/sysconfit/nftables.conf have not been loaded at startup, as they have been up until recently, because it still contains:

To get back to protected status, I must "nft -f" that file and then re-execute the shell script that sets up the Host Access Control entries.
Hopefully you can suggest something that will cause the system to again load /etc/sysconfig/nftables.conf at startup.
-
Hey there! I'm not obviously finding any changes on our end that would explain this, so it might be best to create another ticket so we can check this directly.
0
Please sign in to leave a comment.
Comments
1 comment