Say I have a couple of servers at DigitalOcean and I want them to talk to each others.DigitalOcean offers a WAN connection and a LAN connection. Problem is that both are insecure. The WAN is the Internet and the LAN is shared by everyone who has a computer (VPS) at DigitalOcean.So I want to block everything except a few ports such as 53, 80, 443 on the WAN. That's the standard procedure.Then, maybe I have MySQL on the other computer so I want to open port 3306 for IP address 10.1.1.1 (sample IPs, not actually valid at DigitalOcean.)Now my problem is that I want the firewall rules to be in place before either interface gets started.auto eth0 eth1 iface eth0 inet static        address 8.8.8.2  # some Internet address        netmask 255.255.255.255        gateway 8.8.8.1  # some Internet address        dns-nameservers 8.8.8.8 8.8.4.4        pre-up /etc/network/firewalliface eth1 inet static        address 10.1.1.1        netmask 255.0.0.0        pre-up /etc/network/firewallWhat I came up with is to add the pre-up to both interfaces. That way I'm sure it starts before either one, it also means the script will run twice.Is that the way to do it? Or would there be a better way to have the equivalent of pre-up that's global to all Interfaces?Note: OS is Ubuntu 16.04.1, latest available.
Two interfaces, both require the firewall to be up before starting
networking;iptables;firewall;network interface;reboot
I actually found a solution, since I'm on Ubuntu 16.04 and we have systemd, I just created a script snapinitfirewall.service and installed it along my firewall code.# Documentation available at:# https://www.freedesktop.org/software/systemd/man/systemd.service.html[Unit]Description=Snap! Websites firewall initializationBefore=network.target[Service]Type=oneshotRemainAfterExit=trueExecStart=/etc/network/firewall#ExecStop=... -- why would you ever want to remove your firewall rules?[Install]WantedBy=multi-user.target# vim: syntax=dosini/etc/network/firewall is a script which restores all the rules at once on boot.Because I have another service file for that one package (i.e. one package offering two services) I have to include the following line to make sure the initialization is enabled and runs on reboot:systemctl -q enable snapinitfirewallThis is a much better approach than using the pre-up capability since you can be sure it runs before the network gets started.For those interested by more, the snapfirewall project is on github.