I use Shorewall (on Ubuntu 16.04) and would like to ensure that between the start of the boot process and the moment iptables
rules are applied the network is in a closed state.
There provision for setting such a state in the pre-up
section of /etc/network/interfaces
but I would like to keep all my firewall configuration with Shorewall.
Is this possible?
The problem I see is that Shorewall is set to start after networking is up:
root@ubuntu ~# grep Required-Start /etc/init.d/shorewall
# Required-Start: $network $remote_fs
I was wondering if forcing Shorewall to start before $network
could be a solution, but since this is not a default I fear that there would be unintended consequences of such a change.