Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In a RHEL training document, the author says:

...run the following command to disable the firewall on the current system: iptables -F

He explicitly uses the word "disable" which to me suggests that it will be simple to re-enable. In reading the man page though for iptables, I see this:

Flush the selected chain (all the chains in the table if none is given). This is equivalent to deleting all the rules one by one.

Can I get clarification on the expected behavior?

share|improve this question
1  
Note that iptables -F flushes all the rules in the "filter" table, it doesn't flush the other tables (nat, mangle...) and doesn't restore the policies to their default, so they can't really be said to disable the firewall. –  Stephane Chazelas Jan 21 '13 at 8:24
add comment

2 Answers

up vote 6 down vote accepted

The iptables rules are stored in two places on Red Hat systems:

  • In memory within the running kernel, where the firewall code checks them on network I/O. Flushing the rules with iptables -F gets rid of this ruleset only.

  • In /etc/sysconfig/iptables from which they are loaded on boot. You can force a reload without rebooting with service iptables reload or ...restart.

So the answer is no, flushing the rules with iptables -F is not permanent.

When you go into setup and modify the firewall rules, it saves them in /etc/sysconfig/iptables. You're not supposed to edit that file directly, but if you know the iptables command line format, you can pretty easily figure out the format of this file.

share|improve this answer
    
Fantastic answer. I appreciate the detail and clarification. Thanks Warren. –  Mike B Jan 21 '13 at 3:05
add comment

Also, as a point of reference, here's how to flush ALL the current iptables rules:

#!/bin/sh
echo "Stopping firewall and allowing everyone..."
iptables=/sbin/iptables
$iptables -F
$iptables -X
$iptables -t nat -F
$iptables -t nat -X
$iptables -t mangle -F
$iptables -t mangle -X
$iptables -P INPUT ACCEPT
$iptables -P FORWARD ACCEPT
$iptables -P OUTPUT ACCEPT
share|improve this answer
1  
There are actually more tables than that. At least -t raw and -t security. Instead of hard coding, use /proc/net/ip_tables_names –  derobert Jan 21 '13 at 21:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.