Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can run iptables-save and dump output to stdout but if I redirect to a file - the file is empty:

    [root@nhd-vlx2 tmp]# iptables-save  
    # Generated by iptables-save v1.4.7 on Sun Dec 18 15:11:42 2011
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [90971:17757587]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
    -A INPUT -p icmp -j ACCEPT 
    -A INPUT -i lo -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 9090:9999 -j ACCEPT 
    -A INPUT -j REJECT --reject-with icmp-host-prohibited 
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited 
    # Completed on Sun Dec 18 15:11:42 2011
    [root@nhd-vlx2 tmp]# iptables-save  > save
    [root@nhd-vlx2 tmp]# cat save
    [root@nhd-vlx2 tmp]# 
    [root@nhd-vlx2 tmp]# 

Piping works (iptables-save | cat), and so saving to file through tee works too, but why would iptables-save not allows saving to a file?

The only reason I can think is that this machine may be infected by a virus (an attempt to weaken a firewall)

share|improve this question
let me guess - Red Hat/CentOS? – Rilindo Dec 18 '11 at 21:06
Centos6, this used to be fine on centos5 (but as you suggest, maybe selinux s getting in the way) – nhed Dec 18 '11 at 21:43
up vote 3 down vote accepted

Long shot, but:

Somebody else posted a similar problem in another forum. As it turns out, the SELinux context is wrong.

Run ls -laZ on iptables-multi. It should return with:

-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi

All the other iptables files are symlinked to it:

[root@cacti tmp]# ls -laZ /sbin/iptables*
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables -> iptables-multi
-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables-restore -> iptables-multi
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables-save -> iptables-multi

If the SELinux context is not correct, change it with the chcon command on the main file:

chcon -u system_u -t iptables_exec_t /sbin/iptables-multi

If the SELinux context on the symlinks are not correct, fix them using the above command (although this time with the bin_t type)

share|improve this answer
As far as I can tell the output was the same as yours: rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi ... and the symlinks also look the same lrwxrwxrwx. root root system_u:object_r:bin_t:s0 /sbin/iptables-save -> iptables-multi – nhed Dec 18 '11 at 21:38
Disabling selinux wth echo 0 >/selinux/enforce makes iptables-save behave as expected ... so what is selinux trying to save me from? – nhed Dec 18 '11 at 21:46
The default behavior of selinux wouldn't cause this. You mentioned that this used to be Centos 5 - was this an upgrade or a complete rebuild? – Rilindo Dec 18 '11 at 22:39
At any event, I would probably suggest do a cat on /var/log/audit/audit.log and pipe it to audit2allow to see if it notices anything odd when you attempted to save iptables-save to file with a redirect – Rilindo Dec 18 '11 at 23:05
This a fresh install of Centos6 seen both on a VM and a machine that was formatted+installed. (2) I may have mislead a little, its quite possible that I have disabled selinux on my Centos5.5 host. (3) audit2allow shows allow iptables_t vmblock_t:file write; – nhed Dec 18 '11 at 23:58

As per Rilindo comment, if you are on RedHat the docs mention:

~]# /sbin/service iptables save 
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
share|improve this answer
service iptables save is a wrapper around iptables-save. The difference is that you can use iptables-save to write to any file, while service iptables save writes to /etc/sysconfig/iptables-save and /etc/sysconfig/iptables by default. – Rilindo Dec 18 '11 at 21:32
@Rilindo - Yes, I understand but this would tell us if the iptables is totally ok (which sounds like it is as tee/cat work just redirection fails). So could the shell be globbing the command somehow? – Wayne Dec 18 '11 at 21:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.