Clear and reset iptables in Debian

Question

To clear all rules in iptables I use this

#!/bin/bash
echo "clearing iptables ... "
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

This works so far as there are no entries in iptables any more, which is checked with

sudo iptables -L

or

sudo iptables -S

However, traffic that has been forwarded to a different target still is beeing routed to that target.

That seems like the cleared iptables still are active after clearing them!

Up to now my only way to get rid of those rules is to reboot the system which is not very elegant.

In Debian iptables doesn't seem to run as a service so start or stop of that service doesn't work.

How do I totally clear or reset iptables with the effect that previously defined rules are deactivated?

Answer 1

1. The flushing of the iptables rules doesn't affect on already established connections those has been redirected with DNAT. It's related because the conntrack entry for UDP packets contains the redirecting information, that is used aside the iptables rules.

2. Check the existed conntrack entries with the conntrack -L and monitor the conntrack events with the conntrack -E command.

3. Use the conntrack -F command to clear the conntrack entries. The new UDP packets won't be redirected anymore.

4. To manage the iptables rules as service use the netfilter-persistent and iptables-persistent packages.

5. Better use iptables-save/iptables-restore commands instead manual run of the iptables. It's more safe and atomic.

6. For manage the iptables rules on a remote host use the iptables-apply command, that allow rollback the rule set if it hasn't been confirmed.

Answer 2

sudo ufw status verbose; sudo iptables -L; 

Maybe there is ufw running on? Try to stop.

Could you tell a littlem bit more about your system, network and which traffic is still routed?

1-2 examples are ok incl. the initial firewall rule.

EDIT:

Checked by some of my scripts..... Also flush the chains.

sudo iptables -F INPUT
sudo iptables -F FORWARD 
sudo iptables -F OUTPUT

Answer 3

Your script to clear iptables rules is enough to flush and all rules and set default policy to ACCEPT. This effectively disables the firewall as there are no rules and everything is allowed.

We know, from your comments, you are sending UDP packets. You can feel like the old rules are still active for a while especially when there is a continuous stream of UDP packets going through your firewall machine. This is mainly because UDP does not have a way to close the connection and so the firewall does not know when the current active flow has finished. The only way is to use an idle timeout to flush active "connections" when there is no more packets seen.

You have two options:

1. Wait for some time before trying again. This requires to stop any current active "connections". You can find UDP timeout in /proc/sys/net/netfilter/nf_conntrack_udp_timeout.
2. Use conntrack tool to delete the existing "connections" manually.

Please, note that Linux firewall keeps track of active sockets for TCP/UDP even if UDP is a connection-less protocol.