0

tl;dr How can I persist my iptables on Centos 7?

According to Centos 5 docs I should be able to persist my iptables when the service restarts or stops. I can confirm that this used to be the case, and if I am not mistaken, that was on Centos 7 long ago.

Now, I cannot manage to save any iptables changes unless I manually call the service iptables save command.

However, since I do want to save the counters (i.e. usage) I need to ensure restarts persist the latest counters.

My /etc/sysconfig/iptables-config looks like this:

IPTABLES_MODULES=""
IPTABLES_MODULES_UNLOAD="yes"
IPTABLES_SAVE_ON_STOP="yes"
IPTABLES_SAVE_ON_RESTART="yes"
IPTABLES_SAVE_COUNTER="yes"
IPTABLES_STATUS_NUMERIC="yes"
IPTABLES_STATUS_VERBOSE="no"
IPTABLES_STATUS_LINENUMBERS="yes"

I use: yum info iptables iptables-services xtables-addons

Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: mirrors.coreix.net
 * epel: epel.mirror.wearetriple.com
 * extras: mirrors.coreix.net
 * updates: mirrors.coreix.net
Installed Packages
Name        : iptables
Arch        : x86_64
Version     : 1.4.21
Release     : 18.0.1.el7.centos
Size        : 1.5 M
Repo        : installed
From repo   : base
Summary     : Tools for managing Linux kernel packet filtering capabilities
URL         : http://www.netfilter.org/
License     : GPLv2
Description : The iptables utility controls the network packet filtering code in the
            : Linux kernel. If you need to set up firewalls and/or IP masquerading,
            : you should install this package.

Name        : iptables-services
Arch        : x86_64
Version     : 1.4.21
Release     : 18.0.1.el7.centos
Size        : 25 k
Repo        : installed
From repo   : base
Summary     : iptables and ip6tables services for iptables
URL         : http://www.netfilter.org/
License     : GPLv2
Description : iptables services for IPv4 and IPv6
            :
            : This package provides the services iptables and ip6tables that have been split
            : out of the base package since they are not active by default anymore.

Name        : xtables-addons
Arch        : x86_64
Version     : 2.12
Release     : 1.el7.lux
Size        : 294 k
Repo        : installed
From repo   : lux
Summary     : Extensions targets and matches for iptables
URL         : http://xtables-addons.sourceforge.net
License     : GPLv2 and LGPLv2
Description : Xtables-addons provides extra modules for iptables not present in the kernel,
            : and is the successor of patch-o-matic. Extensions includes new targets like
            : TEE, TARPIT, CHAOS, or modules like geoip, ipset, and account.
            :
            : This package provides the userspace libraries for iptables to use extensions
            : in the xtables-addons-kmod package. You must also install the
            : xtables-addons-kmod package.

Update #1:

I figured out that the iptables-config file is very strict, a single space breaks it and a wrong space allows the parser to ignore it entirely. re-installed and used the original file.

Now the issue I am facing is similar. service iptables stop now does save. Reboot or shut down does not.

Update #2:

The first issue was definitely the iptables-config file. Deleting all iptables related files in /etc/sysconfig and re-installing quickly fixed that.

However, it seems that iptables fails to save due to a permissions issue.

Update #3:

I was missing changing the security level, which I normally do. The bellow command disables the high level security and allows me to save in iptables.

setenforce 0

It's working!

0

centos7 uses firewalld as front for iptables. Follow this link to learn how to use it: https://www.linode.com/docs/security/firewalls/introduction-to-firewalld-on-centos

  • i've disabled that and I am only using iptables, thanks. – ericosg Oct 9 '17 at 10:04
0

It turns out that a series of issues caused my iptables not to save, or not to load, or to save and load and then load something else over it.

As per my updates, my main issues were:

  1. /etc/sysconfig/iptables-config bad format

/etc/sysconfig/iptables-config is very strict. Extra spaces will either break the command or cause it to ignore the command entirely. I re-installed the package and edited the file (after deleting it), to ensure it was correct.

i.e.

service iptables stop     
yum -y install iptables iptables-services     
rm -rf /etc/sysconfig/ipt*     
yum -y reinstall iptables iptables-services

Then edit the file.

nano /etc/sysconfig/iptables-config
  1. Disable Enforcement (security options)

SELinux enforcement was on, and it did not allow the save to occur. I saw this by doing "stop" service iptables stop and noticing that it would fail to save in service iptables status -l. I then disable the SELinux enforcement temporarily, by setenforce 0 and it allowed me to save them. I don't recommend this as a solution, you might find a better one (disabling security behaviors can't be good).

How to thus disable permanently:

nano /etc/sysconfig/selinux

Then change the directive SELinux=enforcing to SELinux=disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.