6

I've got iptables running, as I can use the following command...

sudo /sbin/iptables sudo /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

but I cant do....

service iptables save iptables: unrecognized service

How do I actually save these changes as the mapping stops when I restart the server?

Thank you.

3 Answers 3

3

As far as I know Ubuntu uses UFW in the latest version, so most likely it doesn't have a SysV init script for iptables. If you don't feel comfortable with UFW, you may use sudo iptables-save > /etc/iptables.rules to store your current rules and then invoke sudo iptables-restore < /etc/iptables.rules from rc.local (for example) to restore the rules on startup.

Or, you can add your own init script for iptables as specified here:

#!/bin/sh -e
### BEGIN INIT INFO
# Provides:          iptables
# Required-Start:    mountvirtfs ifupdown $local_fs
# Default-Start:     S
# Default-Stop:      0 6
### END INIT INFO

# July 9, 2007
# James B. Crocker <[email protected]>
# Creative Commons Attribution - Share Alike 3.0 License (BY,SA)
# Script to load/unload/save iptables firewall settings.

PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"

IPTABLES=/sbin/iptables
IPTABLES_SAVE=/sbin/iptables-save
IPTABLES_RESTORE=/sbin/iptables-restore

IPTABLES_CONFIG=/etc/iptables.conf

[ -x $IPTABLES ] || exit 0

. /lib/lsb/init-functions


case "$1" in
start)
    log_action_begin_msg "Starting firewall"
        type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 120" || true
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
    log_action_end_msg $?
    fi
        type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 15" || true
    ;;

stop)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Flushing ALL firewall rules from chains!"
    if $IPTABLES -F ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Deleting ALL firewall chains [Warning: ACCEPTING ALL PORT SERVICES!]"
    if $IPTABLES -X ; then
        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -P FORWARD ACCEPT
        $IPTABLES -P OUTPUT ACCEPT
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

save)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

force-reload|restart)
    log_action_begin_msg "Reloading firewall configuration [Warning: POTENTIAL NETWORK INSECURITY DURING RELOAD]"
    $IPTABLES -F
    $IPTABLES -X
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

*)
    echo "Usage: /etc/init.d/iptables {start|stop|save|restart|force-reload}"
    exit 1
    ;;
esac

exit 0
4
  • when you write about the saving of the iptables, does that mean that when i save them, the system will automagically get them on startup?
    – bharal
    Aug 7, 2014 at 15:21
  • also, the script that you have shown isn't referenced in the link you have... so what is the point of the link?
    – bharal
    Aug 7, 2014 at 15:23
  • @bharal As you can see, it is a link to a wiki page, which could be frequently changed. At the time of writing, the script was referenced there, but apparently that's not the case anymore. I suspect the rest of the answer may be outdated as well, so I'll try to verify that and update it soon. Aug 7, 2014 at 22:18
  • ah, fair. Sorry, i'm new to a lot of the magic of "servers" and "unix", so i was unsure if i was missing some deeper truth. Also, i was frustrated, which is more (entirely, really) my fault than yours.
    – bharal
    Aug 7, 2014 at 22:54
3

Your iptables rule is active once you execute it. Issuing a restart merely restores your iptables config to however it was last saved. There is no need to do the restart.

iptables-save
iptables-restore

will save rules in a plain text file and it will be restored on system startup by the init.d script. see iptables.conf e iptables man for details

3
  • your use of the word "usually" does not inspire any confidence. Is there a reason that a default system wouldn't do this?
    – bharal
    Aug 7, 2014 at 15:20
  • I think it was something related spell checker lol
    – blacksoul
    Aug 8, 2014 at 13:49
  • 'iptables-save' does not store anything, it just prints to STDOUT. use -f to tell it a file path.
    – Andrei
    Dec 30, 2022 at 23:37
1

Why not do it the easy way? In Debian/Ubuntu you can:

1 - create your iptables rules

2 - run sudo apt-get install iptables-persistent; it will ask you if you want to save the rules and restore them after boot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .