91

I add this rule:

sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \
       --dport 1723 -j DNAT --to-destination a.b.c.d:10000
  1. When restart computer rules are deleted. Why?
  2. What I can do to make the rules persist?

6 Answers 6

93

On Debian, install iptables-persistent:

sudo apt-get install iptables-persistent

The package will automatically load /etc/iptables/rules for you during boot.

Any time you modify your rules, run /sbin/iptables-save > /etc/iptables/rules to save them. You can also add that to the shutdown sequence if you like.

3
  • 21
    There are two different rule files: /etc/iptables/rules.v4 and /etc/iptables/rules.v6 for IPv4 and IPv6 respectively. If you want a table to apply to both kinds of connections you have to save it to both rule files. Commented Jan 23, 2014 at 15:51
  • 19
    Don't add it to your shutdown sequence! If you botch your rules during changes/setup at least a good old reboot will get things back to the previously working state.
    – VertigoRay
    Commented Feb 27, 2017 at 23:03
  • 1
    If you want to save both kinds of rules (IPv4 & IPv6, as described by @PetaspeedBeaver) you need to use the ip6tables and ip6tables-save command. So, it's iptables-save > /etc/iptables/rules.v4 for IPv4 iptables rules and ip6tables-save > /etc/iptables/rules.v6 for IPv6 iptables rules.
    – miu
    Commented Aug 30, 2023 at 14:13
73

There is no option in iptables which will make your rules permanent. But you can use iptables-save and iptables-restore to fulfill your task.

First add the iptable rule using the command you gave.

Then save iptables rules to some file like /etc/iptables.conf using following command:

$  iptables-save > /etc/iptables.conf

Add the following command in /etc/rc.local to reload the rules in every reboot.

$  iptables-restore < /etc/iptables.conf
6
  • 22
    On Debian there is the iptables-persistent package which will do this.
    – bahamat
    Commented Oct 20, 2012 at 0:09
  • 12
    It's rather bad idea to place it in rc.local since there would be an open window gap between services start and firewall policy apply. I do prefer using pre-up hook for loopback interface in /etc/network/interfaces to overcome this.
    – poige
    Commented Oct 20, 2012 at 11:07
  • 4
    @bahamat: Installing that package is the best solution, It deserves it's own answer. Commented Oct 20, 2012 at 14:54
  • 1
    @TechZilla: Done.
    – bahamat
    Commented Oct 22, 2012 at 1:52
  • 1
    did not work for me on Raspbian Jessie ... Commented Jan 29, 2017 at 14:12
4

After installing iptables-persistent above you can also save rules with the following shorter command on Ubuntu 16.04+: sudo netfilter-persistent save

And they can also be restored back to how they were last time you saved them with: sudo netfilter-persistent reload

2

Because you did not save the iptables rules.

You can do that by using sudo iptables-save

1
  • 2
    That command only shows the rules on the console.
    – PhoneixS
    Commented Sep 29, 2020 at 16:34
2
  1. Install iptables-persistent package
  2. Whenever you change the rules of iptables, you should save the backup into following file using following command:

iptables-save -f /etc/iptables/rules.v4 (for iptables)

iptables-save -f /etc/iptables/rules.v6 (for ip6tables)

-3

First install the persist iptables (ubunut or debian)

   apt install iptables-persistent

Run your statement:

   iptables -A INPUT -s 0/0 -p tcp --dport 5433 -j ACCEPT

Then save the settings

   iptables-save

Finally restart the machine to verify

reboot
3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .