Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to test/check the syntax of a iptables rules script without modifying the actual firewall config (I think adding and deleting each rule is not the best way...).

I know about the -C option but it doesn't check options like chains and it's a bit tricky with its return codes, because 1 doesn't always mean that syntax is correct.


share|improve this question

As diegows suggested, you can use iptables-restore, however you can use it with the --test flag to just test the configuration, rather than testing it as part of an actual installation.

iptables-restore --test [YOUR RULES AS A FILE]
share|improve this answer

Use iptables-save/iptables-restore. In my opinion, using script is a bad idea. Write your first rules from the command line, then save them with "iptables-save > file" and continue editing that file. "iptables-restore < file" is used to apply the rules. That command will check the syntax and won't apply the rules if there is an error.

share|improve this answer
Also, when playing with iptables on a remote machine, I also set up a cron job to run every 5 or 10 minutes that restores iptables to a default "allow all" state, so if I lock me self out, I'll back in within 5 to 10 minutes. Just remember to lock it down again and disable the cron job ;) – jwbensley Sep 10 '12 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.