Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Shall I flush iptables rules for specific interface if this interface went down?
Does it offer any advantages?

Currently I'm using iptables-restore and I am not deleting rules, even if I sent interface down, rules are just loaded upon boot-up and that's all.

What do you recommended?

share|improve this question
up vote 2 down vote accepted

I wouldn't bother. There might be some edge cases were it could matter to the FW performance (for example if you have thousands of rules, complex fwmarks etc. running for an unused interface).

I have implemented highly available firewalls using vlans, heartbeat, and iptables. In that case, the standby firewall has all of the rules loaded, even though it has none of the IPs (we do create the vlan devices ahead of time though.)

Besides, if you load all your FW rules from one script and then flush only the rules for a single interface you will have to reload all your rules to restore the interface. This will interrupt your established connections unnecessarily.

share|improve this answer

I don't think it's necessary. Also, if you use a DROP policy and flush the wrong thing you can end locked out of the server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.