Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

All the following commands are working as expected. I am posting this just to make sure that I am not doing something that might affect some other service. I have 2 questions:

1) I noticed a few firewall rules were there by default. Why don't I see them anymore?

2) How does iptables work even after stopping the service?

[root@server home]# /etc/init.d/iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255 
3    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0           
5    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353 
6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631 
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631 
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

[root@server home]# /etc/init.d/iptables stop
Flushing firewall rules: [  OK  ]
Setting chains to policy ACCEPT: filter [  OK  ]
Unloading iptables modules: [  OK  ]

[root@server home]# /sbin/iptables -t nat -I PREROUTING -s ! 127.0.0.1 -p tcp --dport 3306 -j REDIRECT --to-ports 4040
[root@server home]# echo $?
0
[root@server home]# /etc/init.d/iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    REDIRECT   tcp  -- !127.0.0.1            0.0.0.0/0           tcp dpt:3306 redir ports 4040 

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         


[root@server home]# /sbin/iptables -t nat -D PREROUTING -s ! 127.0.0.1 -p tcp --dport 3306 -j REDIRECT --to-ports 4040
[root@server home]# echo $?
0

[root@server home]# /etc/init.d/iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Iptables isn't actually a service like, say, apache is a service. iptables is the user-land interface to the kernel's firewall called Netfilter. So by stopping the iptables "service", you're actually just un-loading all of the firewall rules and setting the default policy to ACCEPT.

As to your first question about the rules that are there by default, you'll need to look at the iptables config file for your distro. If you're using a RHEL-based distro, that file is usually /etc/sysconfig/iptables. The reason those rules aren't showing is because they were all flushed from the firewall config when you stopped the iptables "service". All firewall rules you want to be persistant need to be added to this file. If you add an iptables rule on the command line, it'll get lost the next time iptables is restarted or the server is rebooted.

share|improve this answer
    
Are you saying my redirect will stop working once service is rebooted? What is the command I should use to make it permanent? –  shantanuo Aug 9 '11 at 5:20
1  
@shantanuo - after making your changes you can run "service iptables save" to make your changes permanent. This way, the current config is saved to file and loaded next time you restart –  katriel Aug 9 '11 at 5:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.