Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If I edit iptables and then save them then must I reboot for changes to take place?

share|improve this question
2  
What do you mean if mean by 'edit'? –  Zoredache Aug 23 '11 at 17:28
    
sorry... on Ubuntu I issued the iptables-save command after adding a rule. But on my other machine I was still not able to connect. So that made me wonder about general inner workings of iptables. Most docs don't specifically say whether or not a reboot is required. I'm new to this iptables command. Thanks. –  fooledbyprimes Aug 23 '11 at 17:32

1 Answer 1

up vote 9 down vote accepted

Changes to iptables take effect immediately when they are run.

However, your language of "edit and save" makes me think you are editing a conf file or script of some kind rather than actually running the iptables commands.

If you are making your changes in a script, you must make sure that script gets run in order for the changes to take affect. The rules are enforced as soon as the actual commands are sent to the kernel. You will need to figure out how to run the script or apply whatever conf changes you have saved to a file.

share|improve this answer
    
"Changes to iptables take effect immediately when they are run." I tried to verify this in the docs, man docs, webs, etc. But where in the world can I verify this? Thanks. –  fooledbyprimes Aug 23 '11 at 17:34
2  
A reboot actually CLEARS all iptables rules. On first boot the tables will always be empty, you ALWAYS have to set all the rules after booting. That's what the iptables-save helper script thing does ... takes all the current rules and dumps them to a file that can then get re-run on the next boot. Rebooting doesn't make anything take effect, it actually forgets EVERYTHING. If you run iptables -L to list what is in the tables, whatever is there is what is being enforced that instant. This is very easy to prove in practice. –  Caleb Aug 23 '11 at 17:40
    
If you have something that is not "taking effect" it's because you have entered the rules in the wrong order. First match wins. If you have a block rule that matches, the packet will get dropped even if some rule you added later allows it. You need to specifically allow the things you want before you deny everything else. You may need to flush the tables and start over if you have to change the order of something you've already entered. You can also specifically delete rules form the table and added them back in the right order. –  Caleb Aug 23 '11 at 17:42
    
@fooledbyprimes: If you really, really want to "verify" the behavior of iptables do something like 1. from a machine with no rules loaded, ping another 2. in another terminal, issue an iptables command to the OUTPUT chain to drop all packets to the pingee. Effect will be instant. –  Allen Aug 23 '11 at 20:24
1  
@fooledbyprimes: iptables is the user interface to the kernel netfilter subsystem. Changes happen in real time because you are actually modifying part of the kernel. –  MonkeeSage Aug 24 '11 at 14:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.