Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots.

I've found this answer showing how to make a Ubuntu system reload the iptables rules after a reboot but this directory is not present on CentOS.

How do I make this CentOS box load the firewall rules after a reboot?

NOTE: Yes, I'm saving the rules using iptables save and the file is being saved.

This is what is inside /etc/sysconfig/iptables:

# Generated by iptables-save v1.4.7 on Mon Apr  8 09:52:59 2013
*filter
:INPUT ACCEPT [2713:308071]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1649:1766437]
-A INPUT -p tcp -m multiport --dports 25,587,465,110,143,993,995 -m state --state INVALID,NEW,RELATED,ESTABLISHED -m set
 --match-set blocking src -j DROP 
COMMIT
# Completed on Mon Apr  8 09:52:59 2013

the command shows -A INPUT but when I created it I have used -I INPUT.

The rule used to create this was:

iptables -I INPUT -p tcp -m multiport --dports 25,587,465,110,143,993,995 -m state --state NEW,ESTABLISHED,RELATED,INVALID -m set --set blocking src -j DROP
share|improve this question
    
This question was tagged with the ipsets tag even though it seems that the ipsets framework that is available in RHEL/CentOS is not used? For future readers, this works for the ipsets framework: service iptables stop && /etc/sysconfig/ipsets && service iptables start. This picks up the rules defined in /etc/sysconfig/ipsets. –  Christopher Jun 30 at 17:18
    
@Christopher, sounds similar to /etc/sysconfig/network-scripts/rule-* files. Does this ipset file contain definitions of ipset data structures or actual iptables rules? Example? –  rjt Aug 12 at 13:39
1  
@rjt The /etc/sysconfig/ipsets file stores the sets (made with a text editor or with help from the ipset command), and the sets are referenced from the /etc/sysconfig/iptables file. In the link, the author is using them correctly: blog.laimbock.com/2013/09/22/…. –  Christopher Aug 12 at 21:11

4 Answers 4

up vote 1 down vote accepted

You lost rules because:

After adding rules you have to do save before restart service or server. because when you add rule, they are in memory but after saving they will save in file and restore from that file at start-up.

So first You need to save added rules using:

$ /etc/init.d/iptables save

This will save all rules in /etc/sysconfig/iptables, then just enable the iptables service at start-up using:

$ chkconfig --level 53 iptables on

Method 2

To save rules:

$ /sbin/iptables-save  > /etc/iptables.rules

To restore rules [ Add Below entry in /etc/rc.local ]:

$ /sbin/iptables-restore < /etc/iptables.rule
share|improve this answer
1  
I did that and iptables loads when the system starts, but it loads empty. –  SpaceDog Apr 8 '13 at 8:52
    
have you checked /etc/sysconfig/iptables file ? –  Rahul Patil Apr 8 '13 at 8:53
    
after adding rule just do save which I mention above , then it will restore at start-up using /etc/sysconfig/iptables file –  Rahul Patil Apr 8 '13 at 8:54
    
Yes, the file is saved correctly. This is something weird I discovered now: when I do service iptables save I see a message telling me that the rules were saved to /etc/sysconfig/iptables but when I do your command /etc/init.d/iptables save the message tells me that the rules were saved to /etc/sysconfig/ipt. In other words, saved to a different file... why is that? –  SpaceDog Apr 8 '13 at 8:55
1  
nope. The rules are not reloaded after boot. I solved that temporarily by created a crontab that runs a bash script that tests if there are any rules loaded and loads them in not. It is a lame solution, but it is working until I discover a real solution. Thanks. –  SpaceDog Apr 10 '13 at 6:10

I've had the same problem.

You have created a set with ipset called "blocking", however, I don't see where this set gets saved so you'd have to recreate it after ever reboot in a script I guess?

share|improve this answer

Just noticed the same issue on Centos 6.4.

I've just put @reboot /etc/init.d/iptables restart in the crontab and it works.

share|improve this answer

I sent an email to Host Gator and I finally got a response from a Linux Administrator at Host Gator:

Hello there!

HostGator has built a custom firewall that's in place by default on all VPS and dedicated server plans.

Luckliy, there is a file in the firewall configuration that is meant to persist iptables configurations.

The file is this: /etc/firewall/INCLUDE

Just add your iptables lines to that file, and restart the firewall with service firewall restart. The iptables rules will persist.

Actually, I've gone ahead and added those lines to the file, so your iptables rules should load and persist now.

Please don't hesitate to follow up if you have any more questions or concerns

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.