Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to set a rule for making my web server (which runs on port 7000) accessible on port 80:

ptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 7000

This works perfectly so far.

But if I reboot the server the rule is gone. What has do be done do make this rule permanent?

Elias

share|improve this question
add comment

5 Answers

up vote 4 down vote accepted

Which GNU/Linux distribution are you using?

For Debian/Ubuntu the simple solution is to add the iptables call to a post-up hook in /etc/network/interfaces like this:

# The primary network interface
auto eth0
iface eth0 inet dhcp
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 7000
share|improve this answer
add comment

On Red Hat/Fedora based systems:

service iptables save

And make sure that the iptables service is set to start on boot: chkconfig iptables on

share|improve this answer
add comment

Basically you add the iptables commands to the network startup script so it gets run when your network connection is being started.

The files needed change differ from distro to distro.

If you are using Ubuntu (and maybe this is true for Debian and others also) you can use the commands iptables-save and iptables-restore to save configuration over reboots.

share|improve this answer
add comment

For Gentoo

you can add this line to /etc/conf.d/local.start

share|improve this answer
add comment

Rather than calling iptables repeatedly, I suggest the following steps:

[1] Configure iptables to your liking (blocks, antispoofs, redirects, etc.)

[2] Save the iptables configuration:

    iptables-save > /etc/my-iptables.conf

(Or use a name of your liking)

[3] Create a script (e.g. /etc/my-iptables-init.sh) containing these lines:

    #!/bin/bash
    iptrest="<location_of_iptables-restore>"
    cat="/bin/cat"
    conf="/etc/my-iptables.conf"
    #
    $cat $conf | $iptrest

(Some people say that iptables-restore < /etc/my-iptables.con sometimes doesn't work)

[4] Call that script from... wherever you want. Maybe /etc/network/interfaces or (my preference) /etc/rc.local

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.