Problem: iptables resets to default settings after server reboot.

I'm trying to set rule like this:

iptables -I INPUT -p tcp --dport 3000 -j ACCEPT

after that I do:

service iptables save

and it writes back something like this

iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

and after this I just ran (this was done once):

chkconfig iptables on (I have read that this has to be done in order to restore settings after reboot)

After that I reboot and run this command:

systemctl list-unit-files | grep iptables

and I see that iptables.service is enabled, however, the rule (to open port 3000) does not work anymore.

How do I persist these settings?

  • Why didn't you just use firewalld? It is probably still running. – Michael Hampton Sep 5 '14 at 14:06
  • Probably because firewalld is not suited for server environments... – Juan Jimenez Apr 11 '17 at 7:29
up vote 61 down vote accepted

CentOS 7 is using FirewallD now!

Example:

firewall-cmd --zone=public --add-port=3000/tcp --permanent

reload rules:

firewall-cmd --reload
  • 1
    any idea why centos7 image from AWS AMI does not have firewallD. – Saad Masood Sep 7 '15 at 8:32
  • 3
    OR you can disable firewalld and install "iptables-services" package to achieve near native iptables compatibility :) – vagarwal Jun 22 '16 at 15:12
  • 1
    I tried configuring port forwarding 80 -> 8180 for lo (--zone=trusted) with firewalld-cmd but it does not work (it works in --zone=public) Doing so with iptables sudo /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8180 ; sudo /sbin/iptables -t nat -I OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8180 works (but each firewalld --reload loses undoes this) – djb Apr 25 '17 at 13:37
  • @saad: because aws already provides a firewall service hence the ami can be kept small – roothahn Mar 27 at 14:57
  • It is not! I have ordered a Centos 7 VPS and it has iptables by default! The OS version: 7.5.1804 (Core) – codezombie Sep 28 at 19:30

Disable firewalld by the following command:

systemctl disable firewalld

Then install iptables-service by following command:

yum install iptables-services

Then enable iptables as services:

systemctl enable iptables

Now you can save your iptable rules by following command:

service iptables save

On CentOS 7 Minimal you may need to install the iptables-services package (thanks to @RichieACC for the suggestion):

sudo yum install -y iptables-services

And then enable the service using systemd:

sudo systemctl enable iptables.service

And run the initscript to save your firewall rules:

sudo /usr/libexec/iptables/iptables.init save

You can modify directly the /etc/sysconfig/iptables file. Reload the iptables service to reload the rules from that file. Yet, as you were told already, firewalld is the new default firewall system for Centos, and this is a good chance to learn how to use it, don't you think?

  • 6
    in CentOS7 there is no more a /etc/sysconfig/iptables file – roothahn Sep 6 '14 at 9:07
  • 1
    Sorry @roothahn , but it definitely exists... unless you miss some packages of course. From /usr/lib/systemd/system/iptables.service you can see that what's actually launched is "/usr/libexec/iptables/iptables.init start", which is the usual old and dear script looking for the usual old configuration file in /etc/sysconfig – stoned Sep 6 '14 at 15:52
  • 1
    Yeah /etc/sysconfig/iptables doesn't exist for me either. However, /etc/sysconfig/iptables-config does exist. But it does not have firewalls rules inside of it as it the iptables file had before. – Kentgrav Sep 30 '14 at 19:03
  • 1
    I found that the file was not there on a default, minimal install either. CentOS 7 does not install iptables.service by default, it seems. "yum install -y iptables.service" installed the service and created a default /etc/sysconfig/iptables for me. – RichieACC Dec 4 '14 at 8:33
  • 3
    That should be "yum install iptables-services" – qris Jan 4 '15 at 17:15

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.