If I edit iptables and then save them then must I reboot for changes to take place?
asked Aug 23, 2011 at 17:23
-
2What do you mean if mean by 'edit'?– ZoredacheAug 23, 2011 at 17:28
-
sorry... on Ubuntu I issued the iptables-save command after adding a rule. But on my other machine I was still not able to connect. So that made me wonder about general inner workings of iptables. Most docs don't specifically say whether or not a reboot is required. I'm new to this iptables command. Thanks.– fooledbyprimesAug 23, 2011 at 17:32
Add a comment
|
1 Answer
Changes to iptables take effect immediately when they are run.
However, your language of "edit and save" makes me think you are editing a conf file or script of some kind rather than actually running the iptables commands.
If you are making your changes in a script, you must make sure that script gets run in order for the changes to take affect. The rules are enforced as soon as the actual commands are sent to the kernel. You will need to figure out how to run the script or apply whatever conf changes you have saved to a file.
-
"Changes to iptables take effect immediately when they are run." I tried to verify this in the docs, man docs, webs, etc. But where in the world can I verify this? Thanks. Aug 23, 2011 at 17:34
-
2A reboot actually CLEARS all
iptablesrules. On first boot the tables will always be empty, you ALWAYS have to set all the rules after booting. That's what the iptables-save helper script thing does ... takes all the current rules and dumps them to a file that can then get re-run on the next boot. Rebooting doesn't make anything take effect, it actually forgets EVERYTHING. If you runiptables -Lto list what is in the tables, whatever is there is what is being enforced that instant. This is very easy to prove in practice.– CalebAug 23, 2011 at 17:40 -
If you have something that is not "taking effect" it's because you have entered the rules in the wrong order. First match wins. If you have a block rule that matches, the packet will get dropped even if some rule you added later allows it. You need to specifically allow the things you want before you deny everything else. You may need to flush the tables and start over if you have to change the order of something you've already entered. You can also specifically delete rules form the table and added them back in the right order.– CalebAug 23, 2011 at 17:42
-
@fooledbyprimes: If you really, really want to "verify" the behavior of iptables do something like 1. from a machine with no rules loaded, ping another 2. in another terminal, issue an iptables command to the OUTPUT chain to drop all packets to the pingee. Effect will be instant.– AllenAug 23, 2011 at 20:24
-
1@fooledbyprimes: iptables is the user interface to the kernel netfilter subsystem. Changes happen in real time because you are actually modifying part of the kernel. Aug 24, 2011 at 14:00