iptables-restore/nftables-restore service is getting executed before bridge creation during system startup #21899
Description
systemd version the issue has been seen with
249.6
Used distribution
Gentoo
Linux kernel version used (uname -a)
5.10.76-gentoo-r1 #26 SMP Fri Dec 24 15:18:05 EST 2021 x86_64 Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz GenuineIntel GNU/Linux
CPU architecture issue was seen on
x86_64
Expected behavior you didn't see
Successful run of
nftables-restore.serviceduring startup
Unexpected behaviour you saw
nftables.sh[3268]: In file included from /dev/stdin:2:1-39:
nftables.sh[3268]: /var/lib/nftables/rules-save:32:7-11: Error: Interface does not exist
nftables.sh[3268]: iif "br0" oif "eno0" accept
nftables.sh[3268]: ^^^^^
systemd[1]: nftables-restore.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: nftables-restore.service: Failed with result 'exit-code'.
systemd[1]: Failed to start Store and restore nftables firewall rules.
systemd[1]: Reached target Preparation for Network.
Steps to reproduce the problem
Defining a network bridge under /etc/systemd/network
# cat ./br0.netdev
[NetDev]
Name=br0
Kind=bridge
# cat 50-br0.network
[Match]
Name=br0
[Network]
Address=192.168.139.126/25
as well as NFT rules like
#!/sbin/nft -f
...
table inet filter {
...
chain forward {
type filter hook forward priority filter; policy accept;
iif "br0" oif "eno0" accept
iif "eno0" oif "br0" accept
}
...
}
and restarting the system.
Additional program output to the terminal or log subsystem illustrating the issue
This configuration is similar to a working OpenRC configuration. I purposely did not yet have a NIC assigned to br0 as I expect this will be done later by LXC.
I noticed that files
/lib/systemd/system/ip6tables-restore.service
/lib/systemd/system/iptables-restore.service
/lib/systemd/system/nftables-restore.service
all contain section
[Unit]
Before=network-pre.target
Wants=network-pre.target
and therefor seem to get executed before the network daemon actually creates br0 according to the above mentioned configuration.
Am I missing something?