tl;dr How can I persist my iptables on Centos 7?
According to Centos 5 docs I should be able to persist my iptables when the service restarts or stops. I can confirm that this used to be the case, and if I am not mistaken, that was on Centos 7 long ago.
Now, I cannot manage to save any iptables changes unless I manually call the
service iptables save command.
However, since I do want to save the counters (i.e. usage) I need to ensure restarts persist the latest counters.
/etc/sysconfig/iptables-config looks like this:
IPTABLES_MODULES="" IPTABLES_MODULES_UNLOAD="yes" IPTABLES_SAVE_ON_STOP="yes" IPTABLES_SAVE_ON_RESTART="yes" IPTABLES_SAVE_COUNTER="yes" IPTABLES_STATUS_NUMERIC="yes" IPTABLES_STATUS_VERBOSE="no" IPTABLES_STATUS_LINENUMBERS="yes"
yum info iptables iptables-services xtables-addons
Loaded plugins: fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: mirrors.coreix.net * epel: epel.mirror.wearetriple.com * extras: mirrors.coreix.net * updates: mirrors.coreix.net Installed Packages Name : iptables Arch : x86_64 Version : 1.4.21 Release : 18.0.1.el7.centos Size : 1.5 M Repo : installed From repo : base Summary : Tools for managing Linux kernel packet filtering capabilities URL : http://www.netfilter.org/ License : GPLv2 Description : The iptables utility controls the network packet filtering code in the : Linux kernel. If you need to set up firewalls and/or IP masquerading, : you should install this package. Name : iptables-services Arch : x86_64 Version : 1.4.21 Release : 18.0.1.el7.centos Size : 25 k Repo : installed From repo : base Summary : iptables and ip6tables services for iptables URL : http://www.netfilter.org/ License : GPLv2 Description : iptables services for IPv4 and IPv6 : : This package provides the services iptables and ip6tables that have been split : out of the base package since they are not active by default anymore. Name : xtables-addons Arch : x86_64 Version : 2.12 Release : 1.el7.lux Size : 294 k Repo : installed From repo : lux Summary : Extensions targets and matches for iptables URL : http://xtables-addons.sourceforge.net License : GPLv2 and LGPLv2 Description : Xtables-addons provides extra modules for iptables not present in the kernel, : and is the successor of patch-o-matic. Extensions includes new targets like : TEE, TARPIT, CHAOS, or modules like geoip, ipset, and account. : : This package provides the userspace libraries for iptables to use extensions : in the xtables-addons-kmod package. You must also install the : xtables-addons-kmod package.
I figured out that the
iptables-config file is very strict, a single space breaks it and a wrong space allows the parser to ignore it entirely. re-installed and used the original file.
Now the issue I am facing is similar.
service iptables stop now does save. Reboot or shut down does not.
The first issue was definitely the
iptables-config file. Deleting all iptables related files in
/etc/sysconfig and re-installing quickly fixed that.
However, it seems that iptables fails to save due to a permissions issue.
I was missing changing the security level, which I normally do. The bellow command disables the high level security and allows me to save in iptables.