Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In /etc/NetworkManager/dispatcher.d/01ifupdown somewhere at the end:

case "$2" in
 export MODE="start"
 export PHASE="up"

 if [ -d /var/run/network/ ] ; then
  tmpfile=`mktemp -t`
  if [ -e /var/run/network/ifstate ] ; then
   cat /var/run/network/ifstate | grep -v ^$IFACE= > $tmpfile || true
  echo $IFACE=$IFACE >> $tmpfile
  mv $tmpfile /var/run/network/ifstate

 exec run-parts /etc/network/if-up.d
 exec /etc/iptables.rules

I run iptables.rules script, which is shell script containing something like this:

echo "restoring iptables..."
/sbin/iptables-restore -v <<-EOF;



If I run this script from shell then I can see the rule is added. However, after startup the rule is not there. /var/log/messages doesn't show anything, I'm not even sure if the echo from script should be visible there or somewhere else.

share|improve this question
up vote 1 down vote accepted

There are basically two ways to get your firewall configured with such a script.

One of them is to copy the skeleton script in /etc/init.d and modify it to your needs, then create the necessary links (using update-rc.d). This creates a "service" that is started and stopped when runlevels are changed, depending on your settings.

How well this will work with your machine is a different question. NetworkManager only starts interfaces when a user logs on, whereas the runlevel scripts are executed at boot time. Since your network interface(s) don't have IP addresses until NetworkManager has configured them, any iptables rules with IP addresses connected to local interfaces will probably fail.

The other option is to start your firewall scripts from within the /etc/network/interfaces file. In that file there are stanzas that tell the OS how to configure the interfaces. Each interface that should be configured by NetworkManager starts with "allow-hotplug". Usually these stanzas only have that line, as everything else is normally handled by DHCP. HOwever, you can add lines in the format of

up script-with-parameters


down script-with-parameters

which get executed when this particular interface goes up or down (which in fact also happens if somebody pulls the network cable). That should do the trick for you. Read the man page for interfaces(man interfaces).

share|improve this answer

exec causes control to be passed to it's parameter in such a manner that it does not return so anything after exec run-parts /etc/network/if-up.d will not be run.

You will have to find somewhere else to run your iptables.rules script from

share|improve this answer
I also tried to put my script in /etc/network/if-up.d/ and can't see the rule added. – Michael Sep 5 '10 at 1:30
To manage iptables on Ubuntu use the ufw command – Iain Sep 5 '10 at 8:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.