Permament iptables port forwarding?

Question

I have to set a rule for making my web server (which runs on port 7000) accessible on port 80:

ptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 7000

This works perfectly so far.

But if I reboot the server the rule is gone. What has do be done do make this rule permanent?

Elias

Answer 1

Which GNU/Linux distribution are you using?

For Debian/Ubuntu the simple solution is to add the iptables call to a post-up hook in /etc/network/interfaces like this:

# The primary network interface
auto eth0
iface eth0 inet dhcp
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 7000

Answer 2

On Red Hat/Fedora based systems:

service iptables save

And make sure that the iptables service is set to start on boot: chkconfig iptables on

Answer 3

Basically you add the iptables commands to the network startup script so it gets run when your network connection is being started.

The files needed change differ from distro to distro.

If you are using Ubuntu (and maybe this is true for Debian and others also) you can use the commands iptables-save and iptables-restore to save configuration over reboots.

Answer 4

---

For Gentoo

you can add this line to /etc/conf.d/local.start

Answer 5

Rather than calling iptables repeatedly, I suggest the following steps:

[1] Configure iptables to your liking (blocks, antispoofs, redirects, etc.)

[2] Save the iptables configuration:

    iptables-save > /etc/my-iptables.conf

(Or use a name of your liking)

[3] Create a script (e.g. /etc/my-iptables-init.sh) containing these lines:

    #!/bin/bash
    iptrest="<location_of_iptables-restore>"
    cat="/bin/cat"
    conf="/etc/my-iptables.conf"
    #
    $cat $conf | $iptrest

(Some people say that iptables-restore < /etc/my-iptables.con sometimes doesn't work)

[4] Call that script from... wherever you want. Maybe /etc/network/interfaces or (my preference) /etc/rc.local