Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I add this rule:

sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \
       --dport 1723 -j DNAT --to-destination a.b.c.d:10000
  1. When restart computer rules are deleted. Why?
  2. What I can do to make the rules persist?
share|improve this question

2 Answers 2

up vote 7 down vote accepted

There is no option in iptables which will make your rules permanent. But you can use iptables-save and iptables-restore to fulfill your task.

First add the iptable rule using the command you gave.

Then save iptables rules to some file like /etc/iptables.conf using following command:

$  iptables-save > /etc/iptables.conf

Add the following command in /etc/rc.local to reload the rules in every reboot.

$  iptables-restore < /etc/iptables.conf
share|improve this answer
3  
On Debian there is the iptables-persistent package which will do this. –  bahamat Oct 20 '12 at 0:09
3  
It's rather bad idea to place it in rc.local since there would be an open window gap between services start and firewall policy apply. I do prefer using pre-up hook for loopback interface in /etc/network/interfaces to overcome this. –  poige Oct 20 '12 at 11:07
    
@poige: I agree 100%, rc.local might have the intended effect, but it's a kludge in this situation. –  TechZilla Oct 20 '12 at 14:52
1  
@bahamat: Installing that package is the best solution, It deserves it's own answer. –  TechZilla Oct 20 '12 at 14:54
1  
@TechZilla: Done. –  bahamat Oct 22 '12 at 1:52

(Because it was suggested to make this an answer of its own...)

On debian install iptables-persistent.

The package will automatically load /etc/iptables/rules for you during boot.

Any time you modify your rules, run /sbin/iptables-save > /etc/iptables/rules to save them. You can also add that to the shutdown sequence if you like.

share|improve this answer
    
There are two different rule files: /etc/iptables/rules.v4 and /etc/iptables/rules.v6 for IPv4 and IPv6 respectively. If you want a table to apply to both kinds of connections you have to save it to both rule files. –  PetaspeedBeaver Jan 23 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.