Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

(Ubuntu server) Im running

sudo iptables -A INPUT -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 4/sec -j ACCEPT

and then

sudo iptables-save

To get the function of the iptables rules, is it enough to doing only above command (without restarting iptables)?

share|improve this question
5  
Cewebugil: please don't take this the wrong way, but in your time as a member you've asked thirteen questions, and accepted the answer for none of them. We see this as a red "0% accept rate" warning by your username. Local etiquette is that, after a period of time, you accept the best answer to your question by clicking the tick outline by the answer. You don't have to accept any, of course, but you should be aware that people may be less keen to suggest answers for someone who never accepts them. I hope it's OK to note that, in passing. –  MadHatter Mar 13 '11 at 21:44

3 Answers 3

For clarity, the iptables-save command's function is not to activate rules, its purpose is to save the rules for later usage. Common uses are :

iptables-save > iptables.dat

This saves the current rules to iptables.dat. You can restore this rule set with the command:

iptables-restore < iptables.dat

You can put this line in rc.local to restore the rules after reboot, because a reboot clears all rules by default.

share|improve this answer
1  
And don't forget about iptables-apply if you want to stay calm. (10 seconds default) –  gertas Jun 24 '13 at 20:49

Yes, once you have added a rule to iptables it becomes active immediately - this is why you should be careful with your rules as it is possible to lock yourself out.

share|improve this answer

@cewebugil As far as your original question is it is sufficient to apply IPTABLE rules.The moment you apply IPTABLE rule it immediately becomes active.But it will not survive a reboot.

To be able to survive IPTABLES a reboot in your network configuration file /etc/network/interfaces file (I am referring to a Debian/Ubuntu system) you need to add some where
pre-up iptables-restore < firewall.txt

Check this thread confusion in setting up a firewall on bridge and this link http://www.debian-administration.org/articles/445

Two good practises to save your self from a lock

1) It is always a good idea while testing IPTABLES to have a cron job entry that flushes your rules every 15 minutes or so.So that if you by chance apply wrong rule after 15 minutes that rule is deleted and you can login again.That will save you from a possible lock down if some IPTABLE rule was wrong.

2) This can also be done by

 iptables-restore < iptables_rules; sleep 30; iptables-restore < clean_rules

The idea is apply the rules, wait 30 seconds and apply a set of rules to allow all access. When you execute this line, press enter a couple of times and two things can happen:

Your rules locked you out (pressing enter does not show on the screen, so wait the time to run out and they will be cleared; If your rules work and you can see the new lines on the screen, CTRL+C before the sleep ends and you're good.

share|improve this answer
4  
You can alternatively use iptables-apply -t 30 iptables_rules. iptables-apply will wait for you to positively confirm the applied rules, and if after 30 seconds you don't reply, it will revert to the previous rules. –  pepoluan Mar 14 '11 at 8:43
    
@pepoluan thanks for this information I did not knew it. –  Registered User Mar 14 '11 at 20:49
    
yeah, just found out about that myself about last week. now I can't live without it :-) –  pepoluan Mar 15 '11 at 3:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.