Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I start/stop the iptables service on Ubuntu?

I have tried

 service iptables stop

but it is giving "unrecognized service".

Why is it doing so? Is there any other method?

share|improve this question

migrated from stackoverflow.com Apr 3 '10 at 17:36

This question came from our site for professional and enthusiast programmers.

    
I think some of the confusion comes from articles like this: cyberciti.biz/faq/turn-on-turn-off-firewall-in-linux which only applies to Fedora/Red Hat and does claim that you'd find it in /etc/init.d/ it (un)helpfully is the top link you get when googling 'turn off iptables ubuntu'. –  icc97 Feb 15 '13 at 13:55

10 Answers 10

I don't know about "Ubuntu", but in Linux generally, "iptables" isn't a service - it's a command to manipulate the netfilter kernel firewall. You can "disable" (or stop) the firewall by setting the default policies on all standard chains to "ACCEPT", and flushing the rules.

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F

(You may need to flush other tables, too, such as "nat", if you've used them)

The following article on the Ubuntu website describes setting up iptables for use with NetworkManager: https://help.ubuntu.com/community/IptablesHowTo

share|improve this answer
1  
Won't this throw away all current rules for ever? Best to save them somewhere first with sudo iptables-save > /tmp/rules –  Jens Timmerman Sep 21 '12 at 13:07
2  
This doesn't stop the service, but just allows everything through. –  Frederik Nielsen Oct 26 '12 at 6:27
    
Ah, thanks. iptables -F was what I was missing :-) –  Cameron Jan 7 '13 at 1:52

You are all wrong :-)

The command you are looking for is:

$ sudo ufw disable
share|improve this answer
7  
sure if we were talking about ufw, but this post is about iptables –  webjay Oct 26 '12 at 18:54
    
Well, I assumed it was a default install of Ubuntu, and that one doesn't have iptables, but has ufw. –  Frederik Nielsen Oct 26 '12 at 18:58
10  
ufw is just a frontend for iptables: "Iptables is a firewall, installed by default on all official Ubuntu distributions (Ubuntu, Kubuntu, Xubuntu). When you install Ubuntu, iptables is there, but it allows all traffic by default. Ubuntu 8.04 Comes with ufw - a program for managing the iptables firewall easily." help.ubuntu.com/community/IptablesHowTo –  benjaoming Dec 19 '12 at 18:32
1  
Might be, but as ufw == iptables (more or less) in Ubuntu, disabling ufw is equal to disabling iptables. –  Frederik Nielsen Dec 19 '12 at 22:21
    
sudo ufw status verbose; sudo iptables -L; –  user27465 2 days ago

I would first check if it is installed with (it probably is):

dpkg -l | grep iptables

On Ubuntu, iptables is not a service. In order to stop it, you have to do the following :

sudo iptables-save > /root/firewall.rules
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

In order to restore your previous rules :

iptables-restore < /root/firewall.rules

This was taken from http://www.cyberciti.biz/faq/turn-on-turn-off-firewall-in-linux/ and was tested on many Ubuntu 8.X & 9.10 installations.

share|improve this answer

Iptables is a command it's not a service, so generally it's not possible to use commands like

service iptables start

or

service iptables stop

in order to start and stop the firewall, but some distros like centos have installed a service called iptables to start and stop the firewall and a configuration file to configure it. Anyway it's possible to make a service to manage ipotables editing or installing a script for this scope. All services in linux, ubuntu is not an exception, are executable scripts inside /etc/init.d folder, that implements a standard interface (start,stop,restart) A possible script looks like this:

 #!/bin/sh -e
 ### BEGIN INIT INFO
 # Provides:          iptables
 # Required-Start:    mountvirtfs ifupdown $local_fs
 # Default-Start:     S
 # Default-Stop:      0 6
 ### END INIT INFO

 # July 9, 2007
 # James B. Crocker <ubuntu@james.crocker.name>
 # Creative Commons Attribution - Share Alike 3.0 License (BY,SA)
 # Script to load/unload/save iptables firewall settings.

 PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"

 IPTABLES=/sbin/iptables
 IPTABLES_SAVE=/sbin/iptables-save
 IPTABLES_RESTORE=/sbin/iptables-restore

 IPTABLES_CONFIG=/etc/iptables.conf

 [ -x $IPTABLES ] || exit 0

 . /lib/lsb/init-functions


 case "$1" in
 start)
    log_action_begin_msg "Starting firewall"
         type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 120" || true
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
         type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 15" || true
    ;;

 stop)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Flushing ALL firewall rules from chains!"
    if $IPTABLES -F ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Deleting ALL firewall chains [Warning: ACCEPTING ALL PORT SERVICES!]"
    if $IPTABLES -X ; then
        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -P FORWARD ACCEPT
        $IPTABLES -P OUTPUT ACCEPT
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

 save)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

 force-reload|restart)
    log_action_begin_msg "Reloading firewall configuration [Warning: POTENTIAL NETWORK INSECURITY DURING RELOAD]"
    $IPTABLES -F
    $IPTABLES -X
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

 *)
    echo "Usage: /etc/init.d/iptables {start|stop|save|restart|force-reload}"
    exit 1
    ;;
 esac

 exit 0 

This script is part of this tutorial, all the commands to configure the firewall must be inserted, according to the script above, into /etc/iptables.conf file. This script must be inserted into a file called iptables in /etc/init.d and make it executable using

chmod+x *iptables* 

and add the service to runlevels using

update-rc.d iptables defaults

You can add new rules from shell, these rules will be immediatly active and will be added to /etc/iptables.conf when service stops(it means them will be saved for sure when system shutdown).

I hope this will be helpful to everyone.

share|improve this answer

If I recall correctly the suggested way to set up iptables in the ubuntu guides is to set it up as part of the networking scripts. which means there is no /etc/init.d/iptables script like there is in BSD style OS's.

share|improve this answer
    
There was in Debian Woody (did Ubuntu exist then ?), anyway it's still implemented by sysadmins today. Why did they change that any idea ? –  Jimmy Apr 4 '10 at 0:50
    
I've not a clue... but I seem to recall it being one of those annoying things I had to figure out when I set up ubuntu server 9.10 or something... since I wanted a release distro that had a recent postgres and was for servers... otherwise I run arch linux. –  xenoterracide Apr 4 '10 at 20:35

Looks like there several ways to manage firewall in Ubuntu, so you may be interested in reading this: https://help.ubuntu.com/community/IptablesHowTo#Configuration%20on%20startup

To drop all current rules you can use these commands (put them in some script):

iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -F
iptables -t mangle -X
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -F
iptables -t filter -X

In usual case, your default firewall rules saved in some file (for example, /etc/iptables.rules). While booting system command iptables-restore </etc/iptables.rules executed to load firewall rules. So, executing same command after you dropped all rules using above commands will result in "reloading firewall" which you asked for.

share|improve this answer

Create a file on /etc/init.d/

touch fw.rc

Make the file executable chmod +x

Make a symlink to that file on /etc/rc2.d/

ln -s /etc/init.d/fw.rc S80firewall

Edit S80firewall and add the following

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -F

You can add all your custom iptables rules on this file

Now you can restart firewall (iptables) by running /etc/rc2.d/S80firewall (must be root)

share|improve this answer

Because both iptables and ufw are ways to manage the netfilter firewall in Linux, and because both are available by default in Ubuntu, you can use either to start and stop (and manage) firewall rules.

iptables is more flexible, but because ufw provides a very simple interface language for simple and typical function you can use:

sudo ufw disable # To disable the firewall

sudo ufw enable # To enable the firewall

To see current firewall settings use sudo ufw status verbose, or iptables -L .

The Ubuntu Community docs pages on iptables and UFW have a great deal more info.

share|improve this answer

You're using the command that's appropriate for RedHat and CentOS, not Ubuntu or Debian.

http://www.cyberciti.biz/faq/ubuntu-server-disable-firewall/

share|improve this answer

I had an issue that involved only needing to restart the service, this did the trick:

sudo service iptables restart

share|improve this answer
5  
iptables is not service in Ubuntu! –  Hossein Mobasher Jul 17 '12 at 9:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.