3

yesterday i got my self locked from my own server. and than i try to flush iptables from another server to get it unlocked as this question response 3 times fail then lock

After that, i cannot login to the server. i ask support from the customer service and finally i can login as before.

he (customer service) reboot the server and execute iptables -A INPUT -p tcp --dport 22 -j ACCEPT and shutdown the firewall.

and now i want the firewall back as before it flushed.

is it possible to do that? and how to do that?

i read from other forum, they said with just reboot the machine it the ip table will restore to previous state. is it right?

4 Answers 4

3

The firewall as configured by iptables is ephermal. It's never saved and must be reloaded on each boot. Normally there is a script in init.d that loads the iptables rules on boot. When flushing the rules with iptables -F, that only flushes what the Kernel knew, but doesn't affect how the firewall will be setup on next boot. Every distribution is different. Fedora uses a init.d script called /etc/init.d/iptables that just runs iptables-restore /etc/sysconfig/iptables or something like that. Ubuntu uses ufw which calls a series of iptables commands based on local configuration. If all you did was run iptables commands and didn't store anything to a file, then a reboot should restore the firewall. If you know which init.d script, you can probably just reload that script to restore instead of a full reboot.

6
  • so you mean after i reboot the computer, it will just return to previous state. the same as i execute iptables -F ?
    – Jeg Bagus
    Apr 1, 2011 at 7:08
  • Yes and no. Yes, simply rebooting should restore your firewall state to normal if all you did was play with the iptables command which does not save anything to a file. No, -F does not restore your firewall to it's normal boot-up state. It flushes any rules in the current table, but does not load any rules that might have been loaded during boot.
    – penguin359
    Apr 1, 2011 at 7:13
  • i afraid if i reboot and enable the firewall, i cannot login again the same situation with when i execute iptables -F. its really a scary moment.
    – Jeg Bagus
    Apr 1, 2011 at 7:30
  • Without knowing your Linux distribution, I can't help you with specifics on your firewall, but you could add "iptables -A INPUT -p tcp --dport 22 -j ACCEPT" to some start-up script, like /etc/rc.local that runs at the end of boot. Once you reboot, you can test everything and also see if removing that rule locks you out. Run "sudo shutdown -r +5" and then put the command in the background with Ctrl-Z followed by bg. Lastly, remove the above rule with "iptables -D INPUT -p tcp --dport 22 -j ACCEPT" If you get locked out, your server will reboot in 5 minutes and re-add the rule from rc.local.
    – penguin359
    Apr 1, 2011 at 7:52
  • i use centos, i tagged it at begining of my question.
    – Jeg Bagus
    Apr 1, 2011 at 8:04
1

Hm. Can't it have been saved before your flushed? http://www.centos.org/docs/5/html/5.1/Deployment_Guide/s1-iptables-saving.html ?

+= If not, it's near to impossible, unless there're some lost disk files with fw rules inside.

2
  • i don't know if it saved before. but can we still restore it back even it not saved?
    – Jeg Bagus
    Apr 1, 2011 at 6:52
  • You can visit those directory and check out the files inside. + Actually it's a distro-dependent, so I gave this reference only as an example which relates to RHEL and its "relatives".
    – poige
    Apr 1, 2011 at 6:54
1

On Ubuntu from 12.04, the iptables configuration is permanently stored in /etc/default/iptables-rules

You should check if the saved iptables-rules still contains your rules and copy that file before stopping the iptables service or have a back-up of that file ready.

  1. Then you stop the iptables service: sudo service iptables stop
  2. restore the iptables-rules file in /etc/default sudo cp <my backup of iptables> /etc/default/iptables-rules
  3. and start the iptables service sudo service iptables start
1
  • 2
    User228724, welcome to Server Fault! That said, I do hope you'll go on to look at some less-crusty questions that need your answers more. I'm not criticising your answer per se, but this is a three-year old question with an accepted answer. It's also explicitly about CentOS, in which context your answer is definitely wrong (CentOS keeps the firewall rules in /etc/sysconfig/iptables). We value your input, but it'd be even more appreciated on other questions.
    – MadHatter
    Jul 1, 2014 at 8:03
1

I think it all depens on how your iptables rules are set before you do the flushing. I mean the default polices of your chains INPUT, OUTPUT and FORWARD.

So to be sure you won't get locked out when you flush your iptables rules, first make sure the default policies of your chains are completely open. Like so:

iptables -P INPUT ACCEPT

iptables -P FORWARD ACCEPT

iptables -P OUTPUT ACCEPT

And then and only then you can safely flush your rules:

iptables -F

This will work if your problem was that the default policies of your chains were different from ACCEPT.

Of course before you flush them you should do a back up of your rules to a file:

iptables-save > /route/to/file.anyextension

And after your testing you can just restore your old rules:

iptables-restore < route/to/file.anyextension

If you add or delete a rule and you want it to be permanent (so it will keep even if you reboot) you will have to do different things depending on your distro.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .