Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've started encountering an issue with iptables on our RHEL 6.3 systems in that after a reboot, when the service starts, the rules are not loaded. We get the empty ruleset:

[msnyder@matt-test ~]$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

This is in spite of the fact that we have rules defined and the service is, indeed, running. That I know because when I run service iptables start it simply drops back to the prompt. If I run service iptables restart it actually stops and then restarts the service. And, of course, if I run service iptables stop it indicates that iptables is actually stopping.

Knowing that I need to restart the service, I do so and the rules load up properly. They simply don't get loaded after a reboot. Unless they get loaded differently during a reboot I don't see how our rules would be wrong. If they were, they wouldn't even load during a service restart.

Has anyone else ever encountered this?

EDIT: The rules are already saved in /etc/sysconfig/iptables. They are not added on the fly from the command line so service iptables save is unnecessary.

share|improve this question
3  
Have you run service iptables save to actually save the rules? –  fukawi2 Dec 17 '12 at 23:29
    
Netfilter isn't really a service like most daemons that are started. Netfilter is built into the kernel. There is no process that is started or stopped. Stopping/starting/restarting just adds/removes rules to the tables in the kernel. –  Zoredache Dec 17 '12 at 23:31
    
Semantics aside, it isn't working. –  theillien Dec 18 '12 at 15:29
    
What's the output of chkconfig --list iptables? –  MadHatter Mar 22 '13 at 18:00

3 Answers 3

up vote 0 down vote accepted

First iptables should be enabled on startup with chkconfig on But I guess this is already the case since you get an empty table.

A reason for iptables not loading during bootime could be, that you have rules in your configuration using hostnames, if so replace them by IPs and try again. If you absolutely need hostnames in you iptables configuration be sure to enable (and commit) DNS query from your host first, but I am not sure if this will work in any situation.

share|improve this answer

I believe you will need to perform 'service iptables save', as stated above, for the rules to be in place following a reboot. But I would also check the below params in: /etc/sysconfig/iptables-config, to ensure it is saving off running configuration, so you don't lose anything inserted during runtime.

IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
share|improve this answer

We discovered that the problem is not with iptables itself. We have TrendMicro's Deep Security agent running on these servers and it is breaking iptables. They have acknowledged the issue and our workaround which is setting both dsagent and iptables start scripts to the same start sequence number (S08) rather than having dsagent script start after iptables which it defaults to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.