Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

(Ubuntu server) Im running

sudo iptables -A INPUT -s -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 4/sec -j ACCEPT

and then

sudo iptables-save

To get the function of the iptables rules, is it enough to doing only above command (without restarting iptables)?

share|improve this question

For clarity, the iptables-save command's function is not to activate rules, its purpose is to save the rules for later usage. Common uses are :

iptables-save > iptables.dat

This saves the current rules to iptables.dat. You can restore this rule set with the command:

iptables-restore < iptables.dat

You can put this line in rc.local to restore the rules after reboot, because a reboot clears all rules by default.

share|improve this answer
And don't forget about iptables-apply if you want to stay calm. (10 seconds default) – gertas Jun 24 '13 at 20:49

@cewebugil As far as your original question is it is sufficient to apply IPTABLE rules.The moment you apply IPTABLE rule it immediately becomes active.But it will not survive a reboot.

To be able to survive IPTABLES a reboot in your network configuration file /etc/network/interfaces file (I am referring to a Debian/Ubuntu system) you need to add some where
pre-up iptables-restore < firewall.txt

Check this thread confusion in setting up a firewall on bridge and this link

Two good practises to save your self from a lock

1) It is always a good idea while testing IPTABLES to have a cron job entry that flushes your rules every 15 minutes or so.So that if you by chance apply wrong rule after 15 minutes that rule is deleted and you can login again.That will save you from a possible lock down if some IPTABLE rule was wrong.

2) This can also be done by

 iptables-restore < iptables_rules; sleep 30; iptables-restore < clean_rules

The idea is apply the rules, wait 30 seconds and apply a set of rules to allow all access. When you execute this line, press enter a couple of times and two things can happen:

Your rules locked you out (pressing enter does not show on the screen, so wait the time to run out and they will be cleared; If your rules work and you can see the new lines on the screen, CTRL+C before the sleep ends and you're good.

share|improve this answer
You can alternatively use iptables-apply -t 30 iptables_rules. iptables-apply will wait for you to positively confirm the applied rules, and if after 30 seconds you don't reply, it will revert to the previous rules. – pepoluan Mar 14 '11 at 8:43
@pepoluan thanks for this information I did not knew it. – Registered User Mar 14 '11 at 20:49
yeah, just found out about that myself about last week. now I can't live without it :-) – pepoluan Mar 15 '11 at 3:08

Yes, once you have added a rule to iptables it becomes active immediately - this is why you should be careful with your rules as it is possible to lock yourself out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.