32

(Ubuntu server) Im running

sudo iptables -A INPUT -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 4/sec -j ACCEPT

and then

sudo iptables-save

To get the function of the iptables rules, is it enough to doing only above command (without restarting iptables)?

0

3 Answers 3

16

For clarity, the iptables-save command's function is not to activate rules, its purpose is to save the rules for later usage. Common uses are :

iptables-save > iptables.dat

This saves the current rules to iptables.dat. You can restore this rule set with the command:

iptables-restore < iptables.dat

You can put this line in rc.local to restore the rules after reboot, because a reboot clears all rules by default.

1
  • 8
    And don't forget about iptables-apply if you want to stay calm. (10 seconds default)
    – gertas
    Jun 24, 2013 at 20:49
15

@cewebugil As far as your original question is it is sufficient to apply IPTABLE rules.The moment you apply IPTABLE rule it immediately becomes active.But it will not survive a reboot.

To be able to survive IPTABLES a reboot in your network configuration file /etc/network/interfaces file (I am referring to a Debian/Ubuntu system) you need to add some where
pre-up iptables-restore < firewall.txt

Check this thread confusion in setting up a firewall on bridge and this link http://www.debian-administration.org/articles/445

Two good practises to save your self from a lock

1) It is always a good idea while testing IPTABLES to have a cron job entry that flushes your rules every 15 minutes or so.So that if you by chance apply wrong rule after 15 minutes that rule is deleted and you can login again.That will save you from a possible lock down if some IPTABLE rule was wrong.

2) This can also be done by

 iptables-restore < iptables_rules; sleep 30; iptables-restore < clean_rules

The idea is apply the rules, wait 30 seconds and apply a set of rules to allow all access. When you execute this line, press enter a couple of times and two things can happen:

Your rules locked you out (pressing enter does not show on the screen, so wait the time to run out and they will be cleared; If your rules work and you can see the new lines on the screen, CTRL+C before the sleep ends and you're good.

3
  • 15
    You can alternatively use iptables-apply -t 30 iptables_rules. iptables-apply will wait for you to positively confirm the applied rules, and if after 30 seconds you don't reply, it will revert to the previous rules.
    – pepoluan
    Mar 14, 2011 at 8:43
  • @pepoluan thanks for this information I did not knew it. Mar 14, 2011 at 20:49
  • yeah, just found out about that myself about last week. now I can't live without it :-)
    – pepoluan
    Mar 15, 2011 at 3:08
14

Yes, once you have added a rule to iptables it becomes active immediately - this is why you should be careful with your rules as it is possible to lock yourself out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .