Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there any way to test/check the syntax of a iptables rules script without modifying the actual firewall config (I think adding and deleting each rule is not the best way...).

I know about the -C option but it doesn't check options like chains and it's a bit tricky with its return codes, because 1 doesn't always mean that syntax is correct.


share|improve this question

1 Answer 1

Use iptables-save/iptables-restore. In my opinion, using script is a bad idea. Write your first rules from the command line, then save them with "iptables-save > file" and continue editing that file. "iptables-restore < file" is used to apply the rules. That command will check the syntax and won't apply the rules if there is an error.

share|improve this answer
Also, when playing with iptables on a remote machine, I also set up a cron job to run every 5 or 10 minutes that restores iptables to a default "allow all" state, so if I lock me self out, I'll back in within 5 to 10 minutes. Just remember to lock it down again and disable the cron job ;) –  jwbensley Sep 10 '12 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.