3

I've got iptables running, as I can use the following command...

sudo /sbin/iptables sudo /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

but I cant do....

service iptables save iptables: unrecognized service

How do I actually save these changes as the mapping stops when I restart the server?

Thank you.

| improve this question | | | | |
2

As far as I know Ubuntu uses UFW in the latest version, so most likely it doesn't have a SysV init script for iptables. If you don't feel comfortable with UFW, you may use sudo iptables-save > /etc/iptables.rules to store your current rules and then invoke sudo iptables-restore < /etc/iptables.rules from rc.local (for example) to restore the rules on startup.

Or, you can add your own init script for iptables as specified here:

#!/bin/sh -e
### BEGIN INIT INFO
# Provides:          iptables
# Required-Start:    mountvirtfs ifupdown $local_fs
# Default-Start:     S
# Default-Stop:      0 6
### END INIT INFO

# July 9, 2007
# James B. Crocker <ubuntu@james.crocker.name>
# Creative Commons Attribution - Share Alike 3.0 License (BY,SA)
# Script to load/unload/save iptables firewall settings.

PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"

IPTABLES=/sbin/iptables
IPTABLES_SAVE=/sbin/iptables-save
IPTABLES_RESTORE=/sbin/iptables-restore

IPTABLES_CONFIG=/etc/iptables.conf

[ -x $IPTABLES ] || exit 0

. /lib/lsb/init-functions


case "$1" in
start)
    log_action_begin_msg "Starting firewall"
        type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 120" || true
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
    log_action_end_msg $?
    fi
        type usplash_write >/dev/null 2>/dev/null && usplash_write "TIMEOUT 15" || true
    ;;

stop)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Flushing ALL firewall rules from chains!"
    if $IPTABLES -F ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    log_action_begin_msg "Deleting ALL firewall chains [Warning: ACCEPTING ALL PORT SERVICES!]"
    if $IPTABLES -X ; then
        $IPTABLES -P INPUT ACCEPT
        $IPTABLES -P FORWARD ACCEPT
        $IPTABLES -P OUTPUT ACCEPT
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

save)
    log_action_begin_msg "Saving current firewall configuration"
    if $IPTABLES_SAVE > $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

force-reload|restart)
    log_action_begin_msg "Reloading firewall configuration [Warning: POTENTIAL NETWORK INSECURITY DURING RELOAD]"
    $IPTABLES -F
    $IPTABLES -X
    if $IPTABLES_RESTORE < $IPTABLES_CONFIG ; then
        log_action_end_msg $?
    else
        log_action_end_msg $?
    fi
    ;;

*)
    echo "Usage: /etc/init.d/iptables {start|stop|save|restart|force-reload}"
    exit 1
    ;;
esac

exit 0
| improve this answer | | | | |
  • when you write about the saving of the iptables, does that mean that when i save them, the system will automagically get them on startup? – bharal Aug 7 '14 at 15:21
  • also, the script that you have shown isn't referenced in the link you have... so what is the point of the link? – bharal Aug 7 '14 at 15:23
  • @bharal As you can see, it is a link to a wiki page, which could be frequently changed. At the time of writing, the script was referenced there, but apparently that's not the case anymore. I suspect the rest of the answer may be outdated as well, so I'll try to verify that and update it soon. – Vladimir Blaskov Aug 7 '14 at 22:18
  • ah, fair. Sorry, i'm new to a lot of the magic of "servers" and "unix", so i was unsure if i was missing some deeper truth. Also, i was frustrated, which is more (entirely, really) my fault than yours. – bharal Aug 7 '14 at 22:54
2

Your iptables rule is active once you execute it. Issuing a restart merely restores your iptables config to however it was last saved. There is no need to do the restart.

iptables-save
iptables-restore

will save rules in a plain text file and it will be restored on system startup by the init.d script. see iptables.conf e iptables man for details

| improve this answer | | | | |
  • your use of the word "usually" does not inspire any confidence. Is there a reason that a default system wouldn't do this? – bharal Aug 7 '14 at 15:20
  • I think it was something related spell checker lol – blacksoul Aug 8 '14 at 13:49
1

Why not do it the easy way? In Debian/Ubuntu you can:

1 - create your iptables rules

2 - run sudo apt-get install iptables-persistent; it will ask you if you want to save the rules and restore them after boot.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.