69

I currently have this snippet:

# flush all chains
iptables -F
iptables -t nat -F
iptables -t mangle -F
# delete all chains
iptables -X

Is there a possibility that some impervious rule will stay alive after running this?

The idea is to have a completely clean iptables config, that can be easily replaced by new ruleset (nevermind routes/ifconfig's parameters).

91

To answer your question succinctly, no: there would not be any "leftover" rules after flushing every table. In the interest of being thorough however, you may want to set the policy for the built-in INPUT and FORWARD chains to ACCEPT, as well:

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

Clear ip6tables rules:

ip6tables -P INPUT ACCEPT
ip6tables -P FORWARD ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -t nat -F
ip6tables -t mangle -F
ip6tables -F
ip6tables -X

...and that should do it. iptables -nvL should produce this (or very similar) output:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  • 7
    you forgot about 'raw': iptables -t raw -F iptables -t raw -X – kK-Storm Nov 12 '15 at 12:59
19

This will correctly totally reset your iptables system to a very basic state:

iptables-save | awk '/^[*]/ { print $1 } 
                     /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; }
                     /COMMIT/ { print $0; }' | iptables-restore

All policies will be reset to ACCEPT as well as flushing every table in current use. All chains other than the built in chains will no longer exist.

  • 1
    Neat hack! I wouldn't depend on it though, since it's always possible that subtle changes to the save/restore format might break it. Probably best to stick to the API that the iptables tool explicitly provides, IMO. – Steven Monday Nov 11 '10 at 4:44
  • 3
    I changed my mind: the data format is unlikely to change much any more, since it's used so widely. +1. – Steven Monday Nov 11 '10 at 4:54
  • 2
    +1, interesting hack – Sam Halicke Nov 11 '10 at 5:55
2

Whenever I need the firewall disabled is something like this:

  • iptables-save > iptables.bak
  • service iptables stop (i'm on fedora)
0

One can do this in 1 or 2 commands:

 $ sudo iptables-save > iptables.bak
 $ sudo iptables -F

Result:

$ sudo iptables -nvL
Chain INPUT (policy ACCEPT 3138 packets, 5567K bytes)
pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 3602 packets, 6547K bytes)
pkts bytes target     prot opt in     out     source               destination         
  • 5
    If the default policies are currently set to DROP, this is a quick way to get locked out of the server. So, no, it's not a 1 or 2 command process. You need to first set to ACCEPT if it's not currently. – RyanH May 17 '18 at 16:35
0

I've had to block all connections recently what I ended up doing was

iptables-policy INPUT DROP
iptables-policy OUTPUT DROP
iptables-policy FORWARD DROP

as for saving I'd recommend the following

Ubuntu:

/etc/init.d/iptables save
/sbin/service iptables save

RedHat/CentOS:

/etc/init.d/iptables save
/sbin/iptables-save

In addition to backup all current ufw rules Ive used this in the past

cp /lib/ufw/{user.rules,user6.rules} /<BACKUP LOCATION> 
cp /lib/ufw/{user.rules,user6.rules} ./

I think this may be useful for future reference. Thought I would share.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.