Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently have this snippet:

iptables -F // flush all chains
iptables -t nat -F
iptables -t mangle -F
iptables -X // delete all chains

Is there a possibility that some impervious rule will stay alive after running this?

The idea is to have a completely clean iptables config, that can be easily replaced by new ruleset (nevermind routes/ifconfig's parameters).

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

To answer your question succinctly, no: there would not be any "leftover" rules after flushing every table. In the interest of being thorough however, you may want to set the policy for the built-in INPUT and FORWARD chains to ACCEPT, as well:

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

...and that should do it. iptables -nvL should produce this (or very similar) output:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
share|improve this answer
add comment

This will correctly totally reset your iptables system to a very basic state:

iptables-save | awk '/^[*]/ { print $1 } 
                     /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
                     /COMMIT/ { print $0; }' | iptables-restore

All policies will be reset to ACCEPT as well as flushing every table in current use. All chains other than the built in chains will no longer exist.

share|improve this answer
    
Neat hack! I wouldn't depend on it though, since it's always possible that subtle changes to the save/restore format might break it. Probably best to stick to the API that the iptables tool explicitly provides, IMO. –  Steven Monday Nov 11 '10 at 4:44
    
I changed my mind: the data format is unlikely to change much any more, since it's used so widely. +1. –  Steven Monday Nov 11 '10 at 4:54
    
+1, interesting hack –  Sam Halicke Nov 11 '10 at 5:55
add comment

Whenever I need the firewall disabled is something like this: iptables-save > iptables.bak service iptables stop (i'm on fedora)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.