Iptables not persisting after reboot on CentOS 6.2

Question

I've tried adding a few rules to my iptables but they don't seem to be saving. In order to save them, I've tried running iptables-save and service iptables save. Each time I have run either of those commands, it says that it has saved successfully. Here are the rules I am trying to insert:

iptables -A INPUT -j REJECT -p tcp --destination-port 3306
iptables -A INPUT -j REJECT -p tcp --destination-port 25

These rules work and will stay in place after I input them, but when I go to reboot the system they are gone from the list when running iptables -L and the ports are open again (checked using nmap).

When looking at my /etc/sysconfig/iptables file, the rules are there (at the bottom) and all of the "completed" timestamps are from when I saved the rules which seems correct. Also, in my /etc/sysconfig/iptables-config file all of the settings are default and do not seem to change anything as far as loading iptable rules from a different location or something.

Answer 1

If the changes are not visible with iptables -L after a restart, it suggests that either:

• The rules aren't being saved

  • You suggest that they are, but at the same time say 'completed timestamps' - plural. This might imply that you have more than one copy of the rules in the same file, and only the first set is being applied.
    • Redirect the output from iptables-save to the above file (don't append):

      iptables-save > /etc/sysconfig/iptables

    • Alternatively, just move the existing file elsewhere, and then save.

• The rules are being saved to the wrong file

  • Your configuration may be setup to load a different file than the one you are saving to - ensure that the file being loaded matches the file you save to.
    • The file is normally /etc/sysconfig/iptables
    • If you look in /etc/init.d/iptables, you should find the following lines which determine which file will be loaded:

      IPTABLES=iptables
      IPTABLES_DATA=/etc/sysconfig/$IPTABLES

• There is an error with the rules

  • This is usually not an issue - iptables typically just ignores erroneous rules; and you are not writing them by hand (you are saving a presumably working ruleset).

You should be able to test your setup by just restarting iptables (as opposed to restarting the machine):

service iptables restart

---

Standard iptables disclaimer: just in case something goes wrong...

• back up your existing ruleset:

  cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak

• setup a cron job that will flush your iptables after a few minutes (of course, remove this once everything is working).

Answer 2

Are you SURE that iptables-save "ran successfully"? All it does is spit out the current ruleset save file to text. You have to point it to /etc/sysconfig/iptables for that to work.

iptables-save > /etc/sysconfig/iptables

Generally speaking, if you see any output from iptables-save, it just spit the output to your display and that won't do you any good.