4

I am in the process of porting my "configure openvpn server" from ubuntu 14 to debian 8. So far it works well except for this section:

# Set up iptables to forward packets for vpn and do this upon startup.
echo 'iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
exit 0' > /etc/rc.local

It appears that debian 8 does not use this /etc/rc.local file so my vpn server won't forward traffic correctly after a reboot. I have to manually call that script, or execute the commands.

What is the "debian 8 way" for updating the iptables on boot?

Update

After reading that /etc/rc.local should work, I made sure the permissions were set to 755 and updated the script to as follows:

/bin/echo "starting..." > /root/rc.local.log
/sbin/iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -j REJECT
/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
/bin/echo "completed successfully" >> /root/rc.local.log

exit 0

I then created an empty /root/rc.local.log and gave it 777 permissions before rebooting. The file remained empty, making me think that the /etc/rc.local script is not being executed at all.

Improve this question
2
  • The question and suggested answer focus more on rc.local than the Debian way to do iptables, perhaps the title should be updated to reflect this.
    – jla
    Jun 15, 2015 at 23:37
  • @jla, the iptables answer came afterwards and I have just moved that as the correct solution. I do not wish to change the question.
    – Programster
    Jun 16, 2015 at 8:35

2 Answers 2

Reset to default
13

The Debian way of setting up iptables on boot is by using the iptables-persistent package.

Simply install the iptables-persistent package, set up the iptables rules like you want them, and then run netfilter-persistent save. (Note that the command starts with netfilter and not iptables.)

See the man page for netfilter-persistent for more details.

The method for saving the tables has changes since Debian 7 (Wheezy). In Wheezy one would do something like: invoke-rc.d iptables-persistent save.

Improve this answer
2

I don't have a definitive answer for a Debian 8 way of setting up iptables at boot, but rc.local should work.

With systemd, rc.local is handled by /lib/systemd/system/rc-local.service, which is automatically started after the network and runs /etc/rc.local start. The only requirement is that /etc/rc.local is executable:

chmod 755 /etc/rc.local

You also need to have #!/bin/sh at the top of the rc.local file for it to execute with systemd, otherwise you will get errors like Failed at step EXEC spawning /etc/rc.local: Exec format error in red when you run sudo journalctl

Improve this answer
5
  • I have checked the permissions are -rwxr-xr-x and updated the script to use /sbin/iptables instead of just iptables, but it still wont have changed iptables on reboot (using sudo iptables -L to check). Is the rc.local being called too early for iptables commands to be used? Is there a log file for errors when executing rc.local?
    – Programster
    Jun 13, 2015 at 9:23
  • You can view all the logs with journalctl (as root); search for iptables perhaps... Errors appear in red by default.
    – Stephen Kitt
    Jun 13, 2015 at 9:36
  • Ah I see Failed at step EXEC spawning /etc/rc.local: Exec format error and Failed to start /etc/rc.local Compatibility. googling...
    – Programster
    Jun 13, 2015 at 9:43
  • 1
    @Programster add #!/bin/bash to the top of the file
    – Chris Davies
    Jun 13, 2015 at 10:30
  • 1
    @roaima, I figured that out and edited the answer before marking it correct. Unfortunately you can't see it yet because its peer review hasnt been accepted yet.
    – Programster
    Jun 13, 2015 at 11:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .