[SOLVED] Yunohost firewall reload deletes custom rules

[izakis]

Hi aleks,
i added a chain for a country block on iptables by a bash script i wrote,
all works good, it drops all the communications in dual direction for “china” in that case, for inbound and outbound,

the problem is, when yunohost firewall reload command being executed it will flush any chains i added in whatever way, whether its through a script or manually,
its just return all the yunohost defined configurations back,

i have tried to check into firewall.py and i found “no_reload” in if statement
what will check “if not no_reload:” so return function “firewall_reload()”
i did change it to true to check what will happen, and it did no reload as expected but its deleting all of the chains after several seconds,
if i try to list the chains there are nothing there, its all empty, in something about 5 seconds,
so i did set it back to false ,

so my question is, how can i tell yunohost not to delete any of my custom firewall rules after reload?

thank you in advance!

[ljf]

You can use a post_iptable_rules hook to do that: Hooks | Yunohost Documentation

[izakis]

Hello thank you for your reply

can you please explain little bit more? i think i am lost here, i didn’t got you much,
the documentation says:
This hooks is run at the end of the command yunohost firewall reload or equivalent action in webadmin

• $1: True if upnp has succeeded
• $2: True if ipv6 is available

in my case i am using upnp cause my router is limited to 15 ports only and in upnp for some reason it can open probably unlimited ports,
so as i understand reload runs on any upnp execution,

there is something i can do on firewall.py to stop the reload without harming the function? or any other way?

[ljf]

As explained on the beginning of this doc, you can do

mkdir -p /etc/yunohost/hooks.d/post_iptable_rules
nano /etc/yunohost/hooks.d/post_iptable_rules/05-block-china

In this 05-block-china, you can put something like:

#!/bin/bash
# And call your existing bash script here to add your new iptables rules after each yunohost firewall reload

[izakis]

oh i have been on that folder i saw its empty so i didn’t got it,

thank you so much! high appreciated, you’re awesome thank you for your time and support.

[izakis]

works as charm!
thank you again.