Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this is what it looks like:

cat /etc/network/if-pre-up.d/iptables 
#!/bin/sh
/sbin/iptables-restore < /etc/firewall/iptables.rules
/sbin/ip6tables-restore < /etc/firewall/ip6tables.rules

This script works: if I run it as root my firewall rules get applied. But on reboot there are no firewall rules. What am I doing wrong?

On request: the /etc/network/interfaces (I did not touch this file)

jacko@DebianVPS:~$ cat /etc/network/interfaces 
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet dhcp
share|improve this question
    
How do you configure your interfaces? Can you add /etc/network/interfaces file? –  SilentStorm May 27 '13 at 8:30

2 Answers 2

up vote 2 down vote accepted

Use the iptables-persistent package for this task.

Define your rules in /etc/iptables/rules.4 and /etc/iptables/rules.6 and don't forget to activate the service (using update-rc.d, chkconfig or you favourite tool.

share|improve this answer

This problem might be related to the permission bits of your script. What is the output of this command? Does it include your file?

run-parts --test /etc/network/if-pre-up.d
share|improve this answer
    
run-parts --test /etc/network/if-pre-up.d gives /etc/network/if-pre-up.d/iptables, which seems the correct output to me? –  Cheiron May 27 '13 at 8:56
    
ok, so, you should probably check when your script is run. Add a first line like this (date; set; echo) >> /tmp/iptables-cmd.log, so you will see when it is called. I always also print the environment in order to check for any argument passed there. You might decide to run your iptables only after last eth* interface is up, instead of running it every time an interface is added. –  eppesuig May 27 '13 at 9:01
2  
Now that you posted your interfaces I see that you are not using ifupdown, but network-manager. This is why your script is not called. Please check this document: ubuntuforums.org/showthread.php?t=1084308 –  eppesuig May 27 '13 at 9:21
    
Well that explains a lot. I think now im just going with the answer of dawud, that seems to work either way. –  Cheiron May 27 '13 at 9:26
1  
run-parts is a bit picky about the name of scripts and having a dot in the filename was causing the script to be ignored at startup in my case. –  alexm Aug 17 '13 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.