Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to set a rule for making my web server (which runs on port 7000) accessible on port 80:

ptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 7000

This works perfectly so far.

But if I reboot the server the rule is gone. What has do be done do make this rule permanent?


share|improve this question
up vote 4 down vote accepted

Which GNU/Linux distribution are you using?

For Debian/Ubuntu the simple solution is to add the iptables call to a post-up hook in /etc/network/interfaces like this:

# The primary network interface
auto eth0
iface eth0 inet dhcp
post-up iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 7000
share|improve this answer

On Red Hat/Fedora based systems:

service iptables save

And make sure that the iptables service is set to start on boot: chkconfig iptables on

share|improve this answer

Basically you add the iptables commands to the network startup script so it gets run when your network connection is being started.

The files needed change differ from distro to distro.

If you are using Ubuntu (and maybe this is true for Debian and others also) you can use the commands iptables-save and iptables-restore to save configuration over reboots.

share|improve this answer

For Gentoo

you can add this line to /etc/conf.d/local.start

share|improve this answer

Rather than calling iptables repeatedly, I suggest the following steps:

[1] Configure iptables to your liking (blocks, antispoofs, redirects, etc.)

[2] Save the iptables configuration:

    iptables-save > /etc/my-iptables.conf

(Or use a name of your liking)

[3] Create a script (e.g. /etc/ containing these lines:

    $cat $conf | $iptrest

(Some people say that iptables-restore < /etc/my-iptables.con sometimes doesn't work)

[4] Call that script from... wherever you want. Maybe /etc/network/interfaces or (my preference) /etc/rc.local

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.