#1206 should fix that

@2fa Would you mind looking at a comment in #1188 to see if it is related? Thanks in advance, for your time and attention.

@corporate-gadfly your reproduction steps looks very similar to this problem so i would assume that it is related, yes. They've merged it an hour ago so it should be fixed in the next version.

No luck with 8.0.2.

Running:

puppet apply -e 'firewallchain {"PREROUTING:mangle:IPv4": ensure=>"present"}'

continues to give the output:

Notice: /Stage[main]/Main/Firewallchain[PREROUTING:mangle:IPv4]/ensure: defined 'ensure' as 'present'
Notice: firewallchain[PREROUTING:mangle:IPv4]: Creating: Creating Chain 'PREROUTING:mangle:IPv4' with {:name=>"PREROUTING:mangle:IPv4", :ensure=>"present", :purge=>false, :ignore_foreign=>false, :chain=>"PREROUTING", :table=>"mangle", :protocol=>"IPv4", :policy=>"accept"}
Notice: firewallchain[PREROUTING:mangle:IPv4]: Creating: Ensuring changes to 'PREROUTING:mangle:IPv4' persist
Notice: firewallchain[PREROUTING:mangle:IPv4]: Creating: Finished in 0.131559 seconds

Kindly let me know, if I can provide more details.

@corporate-gadfly do you have rules in table before that that contains * symbol anywhere?

You can check iptables-save output to be sure. And also you can check if that chains is already there.

@corporate-gadfly do you have rules in table before that that contains * symbol anywhere?

No.

# iptables-save | grep '*'
*filter

You can check iptables-save output to be sure. And also you can check if that chains is already there.

# iptables-save -t mangle
# Generated by iptables-save v1.8.7 on Fri May 24 13:56:37 2024
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Fri May 24 13:56:37 2024

@corporate-gadfly Looks like my fix works in a non nf_tables version of iptables. iptables-save doesn't output empty tables at all in a new version. Great stuff 😃

I will reopen original issue #1206

TY:

Operating System: Ubuntu 22.04.4 LTS              
          Kernel: Linux 5.15.0-100-generic
    Architecture: x86-64
 Hardware Vendor: VMware, Inc.
  Hardware Model: VMware7,1

and:

# iptables -V
iptables v1.8.7 (nf_tables)

Good day, @2fa.

Coming back to this issue, which still exists in the 8.x versions on Ubuntu 22, I asked, horror of all horrors, ChatGPT if there was a way to have the rules in the default tables show up.

The helpful hint was to add placeholder rules and then remove them. E.g.:

iptables -t nat -A POSTROUTING -j ACCEPT

followed by:

iptables -t nat -D POSTROUTING 1

After this, iptables-save showed me both filter and nat tables in the output.

Now, I know zilch about the nat tables, let alone the chains and the default rules inside them. Could someone more knowledgeable comment on the above hint.

Also, for reference, there is a netfilter bugzilla which mentions the sparseness of iptables-save with respect to default tables.

I was thinking of doing the following (one-time) to flush and recreate the default nat and mangle tables and chains with a default ACCEPT policy allowing all traffic:

sudo iptables -t nat -F
sudo iptables -t nat -N PREROUTING
sudo iptables -t nat -N INPUT
sudo iptables -t nat -N OUTPUT
sudo iptables -t nat -N POSTROUTING
sudo iptables -t nat -P PREROUTING ACCEPT
sudo iptables -t nat -P INPUT ACCEPT
sudo iptables -t nat -P OUTPUT ACCEPT
sudo iptables -t nat -P POSTROUTING ACCEPT

sudo iptables -t mangle -F
sudo iptables -t mangle -N PREROUTING
sudo iptables -t mangle -N INPUT
sudo iptables -t mangle -N FORWARD
sudo iptables -t mangle -N OUTPUT
sudo iptables -t mangle -N POSTROUTING
sudo iptables -t mangle -P PREROUTING ACCEPT
sudo iptables -t mangle -P INPUT ACCEPT
sudo iptables -t mangle -P FORWARD ACCEPT
sudo iptables -t mangle -P OUTPUT ACCEPT
sudo iptables -t mangle -P POSTROUTING ACCEPT

I also experienced this after updating the firewall module from 6.0.0 to 8.1.2.
While the new release worked for already running nodes, it failed to converge on a fresh installation.

It seems that setting an explicit policy for one of the chains in an table is sufficient to make iptables-save include that table in its -output. So I'm using the following workaround (this is only for the raw table):

firewallchain { [ 'PREROUTING:raw:IPv4', 'OUTPUT:raw:IPv4' ]:
  ensure => present,
  policy => 'accept',
}
~>
exec { 'iptables -t raw -P OUTPUT ACCEPT':
  user        => 'root',
  cwd         => '/',
  path        => [ '/usr/bin', '/usr/sbin', ],
  refreshonly => true,
}

Maybe the firewallchain provider should include that additional command when creating the resource?

Just wondering if any progress on this bug or anyone working on it before I dig deeper. We just upgraded and hit with this too