I am in the process of porting my "configure openvpn server" from ubuntu 14 to debian 8. So far it works well except for this section:

# Set up iptables to forward packets for vpn and do this upon startup.
echo 'iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
exit 0' > /etc/rc.local

It appears that debian 8 does not use this /etc/rc.local file so my vpn server won't forward traffic correctly after a reboot. I have to manually call that script, or execute the commands.

What is the "debian 8 way" for updating the iptables on boot?


After reading that /etc/rc.local should work, I made sure the permissions were set to 755 and updated the script to as follows:

/bin/echo "starting..." > /root/rc.local.log
/sbin/iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -s -j ACCEPT
/sbin/iptables -A FORWARD -j REJECT
/sbin/iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
/bin/echo "completed successfully" >> /root/rc.local.log

exit 0

I then created an empty /root/rc.local.log and gave it 777 permissions before rebooting. The file remained empty, making me think that the /etc/rc.local script is not being executed at all.

  • The question and suggested answer focus more on rc.local than the Debian way to do iptables, perhaps the title should be updated to reflect this. – jla Jun 15 '15 at 23:37
  • @jla, the iptables answer came afterwards and I have just moved that as the correct solution. I do not wish to change the question. – Programster Jun 16 '15 at 8:35

The Debian way of setting up iptables on boot is by using the iptables-persistent package.

Simply install the iptables-persistent package, set up the iptables rules like you want them, and then run netfilter-persistent save. (Note that the command starts with netfilter and not iptables.)

See the man page for netfilter-persistent for more details.

The method for saving the tables has changes since Debian 7 (Wheezy). In Wheezy one would do something like: invoke-rc.d iptables-persistent save.


I don't have a definitive answer for a Debian 8 way of setting up iptables at boot, but rc.local should work.

With systemd, rc.local is handled by /lib/systemd/system/rc-local.service, which is automatically started after the network and runs /etc/rc.local start. The only requirement is that /etc/rc.local is executable:

chmod 755 /etc/rc.local

You also need to have #!/bin/sh at the top of the rc.local file for it to execute with systemd, otherwise you will get errors like Failed at step EXEC spawning /etc/rc.local: Exec format error in red when you run sudo journalctl

  • I have checked the permissions are -rwxr-xr-x and updated the script to use /sbin/iptables instead of just iptables, but it still wont have changed iptables on reboot (using sudo iptables -L to check). Is the rc.local being called too early for iptables commands to be used? Is there a log file for errors when executing rc.local? – Programster Jun 13 '15 at 9:23
  • You can view all the logs with journalctl (as root); search for iptables perhaps... Errors appear in red by default. – Stephen Kitt Jun 13 '15 at 9:36
  • Ah I see Failed at step EXEC spawning /etc/rc.local: Exec format error and Failed to start /etc/rc.local Compatibility. googling... – Programster Jun 13 '15 at 9:43
  • 1
    @Programster add #!/bin/bash to the top of the file – roaima Jun 13 '15 at 10:30
  • 1
    @roaima, I figured that out and edited the answer before marking it correct. Unfortunately you can't see it yet because its peer review hasnt been accepted yet. – Programster Jun 13 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.