Debian系统防火墙还是防火墙？

Question

我在Debian 10 Buster的防火墙配置中遇到了一些问题：

[agp@debian10 ~]$ systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2021-07-31 07:12:13 CEST; 16min ago
     Docs: man:firewalld(1)
 Main PID: 721 (firewalld)
    Tasks: 2 (limit: 4915)
   Memory: 43.6M
   CGroup: /system.slice/firewalld.service
           └─721 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid
[agp@debian10 ~]$ systemctl status nftables.service
● nftables.service - nftables
   Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor preset: enabled)
   Active: active (exited) since Sat 2021-07-31 07:12:06 CEST; 16min ago
     Docs: man:nft(8)
           http://wiki.nftables.org
  Process: 387 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=0/SUCCESS)
 Main PID: 387 (code=exited, status=0/SUCCESS) 

然而，在检查系统时，它报告“降级”：

● debian10 
   State: degraded
    Jobs: 0 queued
  Failed: 1 units

并检查问题：

[agp@debian10 ~]$ systemctl | grep fail
● firewall.service               loaded failed failed    Add Firewall Rules to iptables                

我查看了几个不同的论坛和Debian页面，结果却被关于iptables设置和nftable配置的不推荐信息所迷惑，这些信息已经取代了Debian Buster中的iptables。

但这是我的问题开始：

为什么我的系统上有两个防火墙服务，它们的功能是什么？

[agp@debian10 ~]$ systemctl status firewall
● firewall.service - Add Firewall Rules to iptables
   Loaded: loaded (/etc/systemd/system/firewall.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sat 2021-07-31 07:12:10 CEST; 2h 35min ago
  Process: 720 ExecStart=/etc/firewall/enable.sh (code=exited, status=203/EXEC)
 Main PID: 720 (code=exited, status=203/EXEC)
[agp@debian10 ~]$ systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2021-07-31 07:12:13 CEST; 2h 35min ago
     Docs: man:firewalld(1)
 Main PID: 721 (firewalld)
    Tasks: 2 (limit: 4915)
   Memory: 44.9M
   CGroup: /system.slice/firewalld.service
           └─721 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

firewall.service是要用iptable配置的，还是与正在工作的firewalld.service设置冲突？

我感谢你的考虑、建议和关注。干杯!

Answer 1

firewalld.service在安装firwalld包时创建。

带有firewall.service的ExecStart=/etc/firewall/enable.sh和描述：Add Firewall Rules to iptables是手动创建的。在debian wiki中提到了相同的服务(参见示例脚本)