114

How can I start/stop the iptables service on Ubuntu?

I have tried

 service iptables stop

but it is giving "unrecognized service".

Why is it doing so? Is there any other method?

3
  • 1
    I think some of the confusion comes from articles like this: cyberciti.biz/faq/turn-on-turn-off-firewall-in-linux which only applies to Fedora/Red Hat and does claim that you'd find it in /etc/init.d/ it (un)helpfully is the top link you get when googling 'turn off iptables ubuntu'.
    – icc97
    Feb 15, 2013 at 13:55
  • It seems since Ubuntu 16.04, iptables-persistent has been replaced by netfilter-persistent. install it. apt install netfilter-persistent
    – Akhil
    May 28, 2020 at 10:10
  • You can also do this: run the command: ''systemctl disable iptables'' and then the command ''systemctl enable ufw'', finally, restart the server with "reboot". This procedure will keep iptables disabled. Apr 20, 2023 at 2:36

12 Answers 12

104

I don't know about "Ubuntu", but in Linux generally, "iptables" isn't a service - it's a command to manipulate the netfilter kernel firewall. You can "disable" (or stop) the firewall by setting the default policies on all standard chains to "ACCEPT", and flushing the rules.

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F

(You may need to flush other tables, too, such as "nat", if you've used them)

The following article on the Ubuntu website describes setting up iptables for use with NetworkManager: https://help.ubuntu.com/community/IptablesHowTo

4
  • 8
    Won't this throw away all current rules for ever? Best to save them somewhere first with sudo iptables-save > /tmp/rules Sep 21, 2012 at 13:07
  • 10
    This doesn't stop the service, but just allows everything through.
    – Frederik
    Oct 26, 2012 at 6:27
  • 4
    Ah, thanks. iptables -F was what I was missing :-)
    – Cameron
    Jan 7, 2013 at 1:52
  • 1
    @JensTimmerman iptables-save > /tmp/rules saved my day. Thanks
    – blagus
    Jul 12, 2018 at 17:59
51

You are all wrong :-)

The command you are looking for is:

$ sudo ufw disable
8
  • 56
    sure if we were talking about ufw, but this post is about iptables
    – webjay
    Oct 26, 2012 at 18:54
  • 1
    Well, I assumed it was a default install of Ubuntu, and that one doesn't have iptables, but has ufw.
    – Frederik
    Oct 26, 2012 at 18:58
  • 27
    ufw is just a frontend for iptables: "Iptables is a firewall, installed by default on all official Ubuntu distributions (Ubuntu, Kubuntu, Xubuntu). When you install Ubuntu, iptables is there, but it allows all traffic by default. Ubuntu 8.04 Comes with ufw - a program for managing the iptables firewall easily." help.ubuntu.com/community/IptablesHowTo
    – benjaoming
    Dec 19, 2012 at 18:32
  • 2
    Might be, but as ufw == iptables (more or less) in Ubuntu, disabling ufw is equal to disabling iptables.
    – Frederik
    Dec 19, 2012 at 22:21
  • 3
    Most likely the OP was actually interested in disabling firewalls, instead of understanding the intricacies of the iptables service for managing firewalls, so this is a good answer. Oct 21, 2015 at 20:34
39

I would first check if it is installed with (it probably is):

dpkg -l | grep iptables

On Ubuntu, iptables is not a service. In order to stop it, you have to do the following :

sudo iptables-save > /root/firewall.rules
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

In order to restore your previous rules :

iptables-restore < /root/firewall.rules

This was taken from http://www.cyberciti.biz/faq/turn-on-turn-off-firewall-in-linux/ and was tested on many Ubuntu 8.X & 9.10 installations.

1
  • 1
    I don't know why this has so many upvotes, iptables is a kernel module. It is never a "service" that can be "stopped". They are used to tell the kernel how to handle connections. Also in a production environment you should never disable your firewall. If something doesn't work, find the right solution, not the easy one.
    – Broco
    Oct 21, 2016 at 17:51
19

Iptables is a command it's not a service, so generally it's not possible to use commands like

service iptables start

or

service iptables stop

in order to start and stop the firewall, but some distros like centos have installed a service called iptables to start and stop the firewall and a configuration file to configure it. Anyway it's possible to make a service to manage ipotables editing or installing a script for this scope. All services in linux, ubuntu is not an exception, are executable scripts inside /etc/init.d folder, that implements a standard interface (start,stop,restart) A possible script looks like this:

 #!/bin/sh -e
 ### BEGIN INIT INFO
 # Provides:          iptables
 # Required-Start:    mountvirtfs ifupdown $local_fs
 # Default-Start:     S
 # Default-Stop:      0 6
 ### END INIT INFO

 # July 9, 2007
 # James B. Crocker <[email protected]>
 # Creative Commons Attribution - Share Alike 3.0 License (BY,SA)
 # Script to load/unload/save iptables firewall settings.

 PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"

 IPTABLES=/sbin/iptables
 IPTABLES_SAVE=/sbin/iptables-save
 IPTABLES_RESTORE=/sbin/iptables-restore

 IPTABLES_CONFIG=/etc/iptables.conf

 [ -x $IPTABLES ] || exit 0

 . /lib/lsb/init-functions


 case "$1" in
 start)
    log_action_begin_msg "Starting firewall"
         type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 120" || true
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
         type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 15" || true
    ;;

 stop)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Flushing ALL firewall rules from chains!"
    if $IPTABLES -F ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Deleting ALL firewall chains [Warning: ACCEPTING ALL PORT SERVICES!]"
    if $IPTABLES -X ; then
        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -P FORWARD ACCEPT
        $IPTABLES -P OUTPUT ACCEPT
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

 save)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

 force-reload|restart)
    log_action_begin_msg "Reloading firewall configuration [Warning: POTENTIAL NETWORK INSECURITY DURING RELOAD]"
    $IPTABLES -F
    $IPTABLES -X
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

 *)
    echo "Usage: /etc/init.d/iptables {start|stop|save|restart|force-reload}"
    exit 1
    ;;
 esac

 exit 0 

This script is part of this tutorial, all the commands to configure the firewall must be inserted, according to the script above, into /etc/iptables.conf file. This script must be inserted into a file called iptables in /etc/init.d and make it executable using

chmod+x *iptables* 

and add the service to runlevels using

update-rc.d iptables defaults

You can add new rules from shell, these rules will be immediatly active and will be added to /etc/iptables.conf when service stops(it means them will be saved for sure when system shutdown).

I hope this will be helpful to everyone.

1
  • I don't know about "generally" but iptables has been a defined service on Red Hat based distributions for what feels like decades.
    – Roy
    Apr 16, 2021 at 13:48
6

Because both iptables and ufw are ways to manage the netfilter firewall in Linux, and because both are available by default in Ubuntu, you can use either to start and stop (and manage) firewall rules.

iptables is more flexible, but because ufw provides a very simple interface language for simple and typical function you can use:

sudo ufw disable # To disable the firewall

sudo ufw enable # To enable the firewall

To see current firewall settings use sudo ufw status verbose, or iptables -L .

The Ubuntu Community docs pages on iptables and UFW have a great deal more info.

4

Looks like there several ways to manage firewall in Ubuntu, so you may be interested in reading this: https://help.ubuntu.com/community/IptablesHowTo#Configuration%20on%20startup

To drop all current rules you can use these commands (put them in some script):

iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -F
iptables -t mangle -X
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -F
iptables -t filter -X

In usual case, your default firewall rules saved in some file (for example, /etc/iptables.rules). While booting system command iptables-restore </etc/iptables.rules executed to load firewall rules. So, executing same command after you dropped all rules using above commands will result in "reloading firewall" which you asked for.

3

There is none by default, but in recent debian derivatives (including Ubuntu) you can install a service to manage iptables:

sudo apt install iptables-persistent

You can then load previously saved rules:

systemctl start netfilter-persistent

Review what happened:

systemctl status netfilter-persistent

netfilter-persistent.service - netfilter persistent configuration

       Loaded: loaded (/lib/systemd/system/netfilter-persistent.service; enabled; vendor preset: enabled)
       Active: active (exited) since Sun 2019-03-24 10:49:50 IST; 16min ago
     Main PID: 1674 (code=exited, status=0/SUCCESS)
        Tasks: 0
       Memory: 0B
          CPU: 0
       CGroup: /system.slice/netfilter-persistent.service

Mar 24 10:49:50 ubuntu systemd[1]: Starting netfilter persistent configuration...
Mar 24 10:49:50 ubuntu netfilter-persistent[1674]: run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables start
Mar 24 10:49:50 ubuntu netfilter-persistent[1674]: Warning: skipping IPv4 (no rules to load)
Mar 24 10:49:50 ubuntu netfilter-persistent[1674]: run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables start
Mar 24 10:49:50 ubuntu netfilter-persistent[1674]: Warning: skipping IPv6 (no rules to load)
Mar 24 10:49:50 ubuntu systemd[1]: Started netfilter persistent configuration.
Mar 24 11:02:49 ubuntu systemd[1]: Started netfilter persistent configuration.

Or stop the service:

systemctl stop netfilter-persistent

Stopping the service will, by default, not flush iptables (i.e. will not disable the firewall, see man netfilter-persistent).

2

If I recall correctly the suggested way to set up iptables in the ubuntu guides is to set it up as part of the networking scripts. which means there is no /etc/init.d/iptables script like there is in BSD style OS's.

2
  • There was in Debian Woody (did Ubuntu exist then ?), anyway it's still implemented by sysadmins today. Why did they change that any idea ?
    – user126330
    Apr 4, 2010 at 0:50
  • I've not a clue... but I seem to recall it being one of those annoying things I had to figure out when I set up ubuntu server 9.10 or something... since I wanted a release distro that had a recent postgres and was for servers... otherwise I run arch linux. Apr 4, 2010 at 20:35
2

Create a file on /etc/init.d/

touch fw.rc

Make the file executable chmod +x

Make a symlink to that file on /etc/rc2.d/

ln -s /etc/init.d/fw.rc S80firewall

Edit S80firewall and add the following

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -F

You can add all your custom iptables rules on this file

Now you can restart firewall (iptables) by running /etc/rc2.d/S80firewall (must be root)

2

I had the same issue. In fact, there was no iptables-persistent in /etc/init.d

So, I created the iptables-persistent file in /etc/init.d

nano /etc/init.d/iptables-persistent

and wrote the following inside:

#!/bin/sh
#       Written by Simon Richter <[email protected]>
#       modified by Jonathan Wiltshire <[email protected]>
#       with help from Christoph Anton Mitterer
#

### BEGIN INIT INFO
# Provides:          iptables-persistent
# Required-Start:    mountkernfs $local_fs
# Required-Stop:     $local_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# X-Start-Before:    $network
# X-Stop-After:      $network
# Short-Description: Set up iptables rules
# Description:       Loads/saves current iptables rules from/to /etc/iptables
#  to provide a persistent rule set during boot time
### END INIT INFO

. /lib/lsb/init-functions

rc=0

load_rules()
{
    log_action_begin_msg "Loading iptables rules"

    #load IPv4 rules
    if [ ! -f /etc/iptables/rules.v4 ]; then
        log_action_cont_msg " skipping IPv4 (no rules to load)"
    else
        log_action_cont_msg " IPv4"
        iptables-restore < /etc/iptables/rules.v4 2> /dev/null
        if [ $? -ne 0 ]; then
            rc=1
        fi
    fi

    #load IPv6 rules    
    if [ ! -f /etc/iptables/rules.v6 ]; then
        log_action_cont_msg " skipping IPv6 (no rules to load)"
    else
        log_action_cont_msg " IPv6"
        ip6tables-restore < /etc/iptables/rules.v6 2> /dev/null
        if [ $? -ne 0 ]; then
            rc=1
        fi
    fi

    log_action_end_msg $rc
}

save_rules()
{
    log_action_begin_msg "Saving rules"

    #save IPv4 rules
    #need at least iptable_filter loaded:
    /sbin/modprobe -q iptable_filter
    if [ ! -f /proc/net/ip_tables_names ]; then
        log_action_cont_msg " skipping IPv4 (no modules loaded)"
    elif [ -x /sbin/iptables-save ]; then
        log_action_cont_msg " IPv4"
        iptables-save > /etc/iptables/rules.v4
        if [ $? -ne 0 ]; then
            rc=1
        fi
    fi

    #save IPv6 rules
    #need at least ip6table_filter loaded:
    /sbin/modprobe -q ip6table_filter
    if [ ! -f /proc/net/ip6_tables_names ]; then
        log_action_cont_msg " skipping IPv6 (no modules loaded)"
    elif [ -x /sbin/ip6tables-save ]; then
        log_action_cont_msg " IPv6"
        ip6tables-save > /etc/iptables/rules.v6
        if [ $? -ne 0 ]; then
            rc=1
        fi
    fi

    log_action_end_msg $rc
}

flush_rules()
{
    log_action_begin_msg "Flushing rules"

    if [ ! -f /proc/net/ip_tables_names ]; then
        log_action_cont_msg " skipping IPv4 (no module loaded)"
    elif [ -x /sbin/iptables ]; then
        log_action_cont_msg " IPv4"
        for param in F Z X; do /sbin/iptables -$param; done
        for table in $(cat /proc/net/ip_tables_names)
        do
            /sbin/iptables -t $table -F
            /sbin/iptables -t $table -Z
            /sbin/iptables -t $table -X
        done
        for chain in INPUT FORWARD OUTPUT
        do
            /sbin/iptables -P $chain ACCEPT
        done
    fi

    if [ ! -f /proc/net/ip6_tables_names ]; then
        log_action_cont_msg " skipping IPv6 (no module loaded)"
    elif [ -x /sbin/ip6tables ]; then
        log_action_cont_msg " IPv6"
        for param in F Z X; do /sbin/ip6tables -$param; done
        for table in $(cat /proc/net/ip6_tables_names)
        do
            /sbin/ip6tables -t $table -F
            /sbin/ip6tables -t $table -Z
            /sbin/ip6tables -t $table -X
        done
        for chain in INPUT FORWARD OUTPUT
        do
            /sbin/ip6tables -P $chain ACCEPT
        done
    fi

    log_action_end_msg 0
}

case "$1" in
start|restart|reload|force-reload)
    load_rules
    ;;
save)
    save_rules
    ;;
stop)
    # Why? because if stop is used, the firewall gets flushed for a variable
    # amount of time during package upgrades, leaving the machine vulnerable
    # It's also not always desirable to flush during purge
    echo "Automatic flushing disabled, use \"flush\" instead of \"stop\""
    ;;
flush)
    flush_rules
    ;;
*)
    echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
    exit 1
    ;;
esac

exit $rc

and then gave chmod 755 permission.

chmod 755 /etc/init.d/iptables-persistent

Now it works perfectly! Hope it can help someone.

2

If you're running Ubuntu server as a VM guest (e.g. in VirtualBox) then libvirt may be enabled. If so libvirt contains some in-built network filters which utilise iptables. These filters may be configured as described in the firewall section on nwfilters.

To disable the iptables rules you'll either need to remove all offending rules from libvirt, or you can just disable libvirt if you're not using it - e.g. install a manual override config (then reboot):

sudo bash -c 'echo "manual" > /etc/init/libvirt-bin.override'
1

You're using the command that's appropriate for RedHat and CentOS, not Ubuntu or Debian.

http://www.cyberciti.biz/faq/ubuntu-server-disable-firewall/

You must log in to answer this question.