Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
38

iptables-persistent does not work that way. Restarting the iptables-persistent "service" does not capture the current state of the iptables and save it; all it does is reinstate the iptables rules that were saved when the package was last configured. To configure iptables-persistent, you need to tell it about your current iptables ruleset. One way to ...


7

Very simple way to save the current iptables rules is to use the command: sudo service netfilter-persistent save Using the above, which works at least in Ubuntu after installing the netfilter-persistent (and iptables-persistent) package, there is no need to run manually the iptables commands or to reconfigure the package (as suggested by even the accepted ...


5

In general, you can edit the active iptables rules for IPv4 with a text editor by using the iptables-save command to write the rules to a file and then using the iptables-restore command to reload the new rules after you're done, e.g.: user@host:~$ iptables-save > rules.v4 user@host:~$ vim rules.v4 user@host:~$ iptables-restore rules.v4 For IPv6 you ...


5

The documentation you have linked is outdated. The binary package you need is now named netfilter-persistent. But don't worry, you have it already installed because iptables-persistent is now a plugin to netfilter-persistent, which was installed with it. So everything was okay and you should really move the documentation directory back to where it belongs. ...


4

--direct commands cannot be made permanent. Use equivalent zone command: sudo firewall-cmd --zone=public --add-port=7199/tcp --permanent sudo firewall-cmd --reload and to check the result: sudo firewall-cmd --zone=public --list-all


4

That's a very basic networking thing: If you want to connect different LAN segments, you need a router. You don't need NAT, you don't need iptables, you just route, plain and simple. For some reason people seem to think routing needs at least NAT or iptables, and the internet is full of advice to that end. It's really not necessary, and a pet peeve of mine. ...


3

From the looks of it you're describing a NAT. A NAT (Network Address Translation) is where traffic from one network (LAN) is masqueraded as coming from another server (WAN) which typically sits in between the 2 networks. server #1 +-----------------+ ...


3

$ iptables ... DROP //command successfully drops the rule $ sudo iptables -L //shows rule has been deleted That's not what DROP means or does. From man iptables: ...the special values ACCEPT, DROP, QUEUE or RETURN. ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means... So what you've done is add a new ...


3

I would look at your startup scripts, most likely /etc/rc.d/rc.local, and find out where the iptables startup rules are coming from. To flush rules from all filter chains, you can do iptables -t filter -F.


3

The --noflush option for iptables-restore doesn't work for user-defined chains, such as TESTCHAIN, only builtin chains. Your best bet is to consolidate all of the TESTCHAIN rules into a single file and import that ruleset using iptables-restore. You could find all the rules with something along the lines of: egrep -r "\sTESTCHAIN\s" ...


2

Stopping iptables from starting during bootup using chkconfig would normally solve your problem, however since you mentioned that you had some "Cyber Security" people work on your server it's possible that iptables is configured to start using a non-standard method. Adding commands to the file /etc/rc.local is one such method. Any commands in the file are ...


2

/etc/rc.local is a symlink to /etc/rc.d/rc.local in CentOS 7 so you have to ensure that /etc/rc.d/rc.local is executable if you want to start things this way, so you can do: chmod +x /etc/rc.d/rc.local and then to start the service: systemctl start rc-local


2

As user A.B. points out there is an issue with incompatibility between nftables, which Buster uses, and iptables. The best way to save iptables rules to be restored with iptables-restore between compatible versions. Remove the offending line, and restore the rules: iptables-restore < rules.q Re-add the rule to your configuration and save: iptables -...


2

You're probably adding a rule intended for the nat table in the filter table block suitable for iptables-restore, and with inappropriate syntax. Until you know how to edit /etc/iptables/rules.v4 directly (by studying the output of iptables-save), you should do this instead: be careful, since the rule will be applied immediately, change the current running ...


2

Why don't you just make a script like this: #!/bin/bash ... ${YOUR_IPTABLES_RULES} ... And then just launch the script every time you reboot your machine: # vim /etc/crontab @reboot root /bin/bash /root/bin/myiptablesrules.sh This way you would habe persistent rules, too :)


2

The problem you've got is that you're not allowing any incoming packets. So if you try and reach out to an external server then you can't receive the replies! This, typically, can be handled with an "established" rule -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT The idea, here, is that incoming packets that match an outgoing connection will be ...


1

Have you tried using the iptables-save command? iptables-save > /path/to/file ip6tables-save > /path/to/file iptables-restore < /path/to/file ip6tables-restore < /path/to/file You could just save to file manually and add the restore command to run at boot or login. The resulting files are easily human readable and contain the equivalent ...


1

As iptables -d accepts networks in CIDR notation, you can probably just change your grep to finding ranges specified with a - and then swap your commands (or negate the result from grep).


1

No. The kernel doesn't know anything about names. The in-kernel rules have IP addresses only. Saving and restoring those rules with iptables-save and iptables-restore uses a textual format that is a reversible exact representation of what's in the kernel and therefore also doesn't deal in names. The closest thing you can do to what you want is probably to ...


1

Here's your rules with regard to incoming traffic on port 2222: iptables -A INPUT -i eth0 -p tcp --sport 2222 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p udp --sport 2222 -m state --state ESTABLISHED -j ACCEPT You aren't allowing NEW connections, so you won't be able to connect from outside. This question might now be of ...


1

As explained by @steven-monday, you can save your rule set by yourself in the proper directory (namely: /etc/iptables/rules.v{4,6}). However, @OpenITeX is right: calling the save action of service netfilter-persistent is better. As of today (in 18.10), iptables-save is builtin, but iptables-persistent is not installed. Hence, the plugin directory called ...


Only top voted, non community-wiki answers of a minimum length are eligible