Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I never quite got why this isn't some built in setup, although maybe it is and stuff changes so quickly I just missed it. I can use iptables-save to generate something I can feed into iptables-restore, but what I was wondering is if there was a standard place to put it so that it gets picked up on boot without me having to add something to rc.local or the ever changing init/event.d scripts.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

From the Ubuntu community help site it seems that Ubuntu has no default method to save rules, but the site suggests two ways:

  • pre-up and post-down statements in /etc/network/interfaces
  • scripts in /etc/network/if-pre-up.d and ../if-post-down.d

See this page for details.

Personally I prefer to use Shorewall and Shorewall6 to simplify iptables configuration, which restores iptables rules at startup automatically.

share|improve this answer

I think it is pretty common for people to use a front-end to iptables like firehol, shorewall, etc, or many others instead of manipulating the tables themselves. Most of these packages setup init scripts to install the rules at boot time for you, and you place your rules in a configuration file appropriate to that tool.

My preference is firehol, I really like the simplified syntax that I get. You don't have to sacrifice flexibility, you can create far more complex rules when you need them. It creates lots of chains to make the rule processing a lot more efficient then you typically see in rules sets entered by hand.

share|improve this answer
    
Shorewall has a nice feature where you can save a default configuration; if you try to apply a new config that fails for some reason, it will re-apply the saved configuration. –  Tim Howland Mar 27 '10 at 0:26
    
@Tim Howland, with firehol if you use firehol try it too will attempt to install a new config and revert to the previous running config if there are any failures. –  Zoredache Mar 27 '10 at 0:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.