Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've tried adding a few rules to my iptables but they don't seem to be saving. In order to save them, I've tried running iptables-save and service iptables save. Each time I have run either of those commands, it says that it has saved successfully. Here are the rules I am trying to insert:

iptables -A INPUT -j REJECT -p tcp --destination-port 3306
iptables -A INPUT -j REJECT -p tcp --destination-port 25

These rules work and will stay in place after I input them, but when I go to reboot the system they are gone from the list when running iptables -L and the ports are open again (checked using nmap).

When looking at my /etc/sysconfig/iptables file, the rules are there (at the bottom) and all of the "completed" timestamps are from when I saved the rules which seems correct. Also, in my /etc/sysconfig/iptables-config file all of the settings are default and do not seem to change anything as far as loading iptable rules from a different location or something.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

If the changes are not visible with iptables -L after a restart, it suggests that either:

  • The rules aren't being saved

    • You suggest that they are, but at the same time say 'completed timestamps' - plural. This might imply that you have more than one copy of the rules in the same file, and only the first set is being applied.
      • Redirect the output from iptables-save to the above file (don't append):
        iptables-save > /etc/sysconfig/iptables
      • Alternatively, just move the existing file elsewhere, and then save.

  • The rules are being saved to the wrong file

    • Your configuration may be setup to load a different file than the one you are saving to - ensure that the file being loaded matches the file you save to.
      • The file is normally /etc/sysconfig/iptables
      • If you look in /etc/init.d/iptables, you should find the following lines which determine which file will be loaded:
        IPTABLES=iptables
        IPTABLES_DATA=/etc/sysconfig/$IPTABLES
  • There is an error with the rules

    • This is usually not an issue - iptables typically just ignores erroneous rules; and you are not writing them by hand (you are saving a presumably working ruleset).

You should be able to test your setup by just restarting iptables (as opposed to restarting the machine):

service iptables restart


Standard iptables disclaimer: just in case something goes wrong...

  • back up your existing ruleset:
    cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak
  • setup a cron job that will flush your iptables after a few minutes (of course, remove this once everything is working).
share|improve this answer
add comment

Are you SURE that iptables-save "ran successfully"? All it does is spit out the current ruleset save file to text. You have to point it to /etc/sysconfig/iptables for that to work.

iptables-save > /etc/sysconfig/iptables

Generally speaking, if you see any output from iptables-save, it just spit the output to your display and that won't do you any good.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.