[Unit]
Description=Roentgen persistent traffic guard and incoming-flow classification
DefaultDependencies=no
After=local-fs.target
Before=network-pre.target NetworkManager.service systemd-networkd.service roentgen.service
Wants=network-pre.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/roentgen guard
RemainAfterExit=yes
UMask=0077
NoNewPrivileges=yes
ProtectHome=yes
ProtectSystem=strict

[Install]
WantedBy=network-pre.target