I have an /etc/init.d/iptables start|stop|restart script on different ubuntu servers (which is a normal shell script)

For each new service I have to edit and insert a line to open a port. This leads to many different versions of the init.d script on different machines.

Is it possible to automatically include let's say all files in /etc/iptables/include.d/ ?

The target is that there should only a line in the start function of /etc/init.d/iptables like

include /etc/iptables/include.d/*

And after an additional file in /etc/iptables/include.d/ I'd simply say

/etc/init.d/iptables restart

Edit: As Saurabh pointed out this can lead to problems when commands need a certain order. An advanced setup could have different directories like:


and including them like this:

    include /etc/iptables/include01.d/*
    ... maybe some code goes here in the main file...
    include /etc/iptables/include02.d/*
    include /etc/iptables/include03.d/*

6 Answers 6


Add the following line to your init.d script.

run-parts --report /etc/iptables/include.d

It will run everything in the directory as a shell script (need to be executable).

If you you only want to execute files that ends with .port you could use something like:

run-parts --regex '\.port$' /etc/iptables/include.d/

If you want to make sure the order is correct you can name the files:

for f in /etc/iptables/include.d/*
 . $f

note space between dot and %f

Saurabh is right - this will not necessary work as you intend, but use some naming convention eg 10-xxx, 20-yyy and so on and it might be manageable.

  • i think this is great, because i do not rely on an external command (run-parts)
    – user12096
    Jul 16, 2009 at 20:39
  • will the order of the files when numbered 10-xxx, 20-yyy be respected automatically by the for f in ?
    – user12096
    Jul 18, 2009 at 10:49
  • @matnagel - should be. if you have any doubts, replace /etc/iptables/include.d/* with ls -1 /etc/iptables/include.d/*.extension - with ls you can control sorting criteria, default one is by name. notice special quote symbol.
    – pQd
    Jul 18, 2009 at 11:48

You can define simple function in bash:

function include() {
    for FILE in $( find "$1" -type f -print | sort )
        source $FILE

and then:

include some_dir/*

or even:

include some_dir/*.conf
  • this is even better than pQd's solution.
    – user12096
    Jul 16, 2009 at 20:40

You may also consider building the iptables script from template files, one of which would be the original iptables script. create a script which will read your template files in the relevant directories and create a new iptables script from them. That way when you need to make changes you do so in the templates and just rerun your script generator.

Using this method you could even get fancy and place markers in the base template which can be used to signal when to include files from specific directories in your template tree.


I do not think you can include files in iptables configuration. The choice makes sense as firewall rules depend a lot on order in which they are written. If we just include files in folder, iptables wont know which rules to put first and which later.

  • this is a good point. thank you for pointing this out. i am updating the question to use several include.d directories, so I can give them an order. I have many services that do not depend on each other and the setup would still make sense in these cases.
    – user12096
    Jul 16, 2009 at 10:21

To well behave with empty dir include.d/ you can do:

for f in /etc/iptables/include.d/*; do
  [[ -e "${f}" ]] && . "${f}"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.