80

Problem: iptables resets to default settings after server reboot.

I'm trying to set rule like this:

iptables -I INPUT -p tcp --dport 3000 -j ACCEPT

after that I do:

service iptables save

and it writes back something like this

iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

and after this I just ran (this was done once):

chkconfig iptables on (I have read that this has to be done in order to restore settings after reboot)

After that I reboot and run this command:

systemctl list-unit-files | grep iptables

and I see that iptables.service is enabled, however, the rule (to open port 3000) does not work anymore.

How do I persist these settings?

Improve this question
2
  • 1
    Why didn't you just use firewalld? It is probably still running.
    – Michael Hampton
    Sep 5, 2014 at 14:06
  • 2
    Probably because firewalld is not suited for server environments...
    – Juan Jimenez
    Apr 11, 2017 at 7:29

6 Answers 6

Reset to default
74

CentOS 7 is using FirewallD now! Use the --permanent flag to save settings.

Example:

firewall-cmd --zone=public --add-port=3000/tcp --permanent

Then reload rules:

firewall-cmd --reload
Improve this answer
5
  • 2
    any idea why centos7 image from AWS AMI does not have firewallD.
    – Saad Masood
    Sep 7, 2015 at 8:32
  • 6
    OR you can disable firewalld and install "iptables-services" package to achieve near native iptables compatibility :)
    – vagarwal
    Jun 22, 2016 at 15:12
  • 1
    I tried configuring port forwarding 80 -> 8180 for lo (--zone=trusted) with firewalld-cmd but it does not work (it works in --zone=public) Doing so with iptables sudo /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8180 ; sudo /sbin/iptables -t nat -I OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-port 8180 works (but each firewalld --reload loses undoes this)
    – djb
    Apr 25, 2017 at 13:37
  • @saad: because aws already provides a firewall service hence the ami can be kept small
    – sgohl
    Mar 27, 2018 at 14:57
  • It is not! I have ordered a Centos 7 VPS and it has iptables by default! The OS version: 7.5.1804 (Core)
    – Mehdi Haghgoo
    Sep 28, 2018 at 19:30
106

Disable firewalld by the following command:

systemctl disable firewalld

Then install iptables-service by following command:

yum install iptables-services

Then enable iptables as services:

systemctl enable iptables

Now you can save your iptable rules by following command:

service iptables save
Improve this answer
0
32

On CentOS 7 Minimal you may need to install the iptables-services package (thanks to @RichieACC for the suggestion):

sudo yum install -y iptables-services

And then enable the service using systemd:

sudo systemctl enable iptables.service

And run the initscript to save your firewall rules:

sudo /usr/libexec/iptables/iptables.init save
Improve this answer
8 
iptables-save > /etc/sysconfig/iptables

will save the current configuration without the need to install any other libraries or services.

Improve this answer
1
  • 1
    From its manpage : iptables-save — dump iptables rules to stdout. It doesn’t save anything unless you redirect it to some file.
    – Skippy le Grand Gourou
    Jun 30, 2020 at 13:50
2

Maybe a script like this would have been helpful to anyone?

Beware that you will loose anything currently configured because it removes firewalld and flushes any current rules in the INPUT table:

yum remove firewalld && yum install iptables-services

iptables --flush INPUT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT            # Any packages related to an existing connection are OK
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT   # ssh is OK
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT   # Port 3000 for IPv4 is OK
iptables -A INPUT -j REJECT # any other traffic is not welcome - this should be the last line
service iptables save       # Save IPv4 IPTABLES rules van memory naar disk
systemctl enable iptables   # To make sure the IPv4 rules are reloaded at system startup

I guess you want the same in case your system might be reached (now or anytime later) by IPv6 traffic:

ip6tables --flush INPUT
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT            # Any packages related to an existing connection are OK
ip6tables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT   # ssh is OK
ip6tables -A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT   # Port 3000 for IPv6 is OK
ip6tables -A INPUT -j REJECT # any other traffic is not welcome - this should be the last line
service ip6tables save       # Save IPv6 IPTABLES rules van memory naar disk
systemctl enable ip6tables   # To make sure the IPv6 rules are reloaded at system startup
Improve this answer
2

You can modify directly the /etc/sysconfig/iptables file. Reload the iptables service to reload the rules from that file.

Yet, as you were told already, firewalld is the new default firewall system for Centos, and this is a good chance to learn how to use it, don't you think?

Improve this answer
6
  • 7
    in CentOS7 there is no more a /etc/sysconfig/iptables file
    – sgohl
    Sep 6, 2014 at 9:07
  • 1
    Sorry @roothahn , but it definitely exists... unless you miss some packages of course. From /usr/lib/systemd/system/iptables.service you can see that what's actually launched is "/usr/libexec/iptables/iptables.init start", which is the usual old and dear script looking for the usual old configuration file in /etc/sysconfig
    – stoned
    Sep 6, 2014 at 15:52
  • 1
    Yeah /etc/sysconfig/iptables doesn't exist for me either. However, /etc/sysconfig/iptables-config does exist. But it does not have firewalls rules inside of it as it the iptables file had before.
    – Kentgrav
    Sep 30, 2014 at 19:03
  • 2
    I found that the file was not there on a default, minimal install either. CentOS 7 does not install iptables.service by default, it seems. "yum install -y iptables.service" installed the service and created a default /etc/sysconfig/iptables for me.
    – Richard C
    Dec 4, 2014 at 8:33
  • 4
    That should be "yum install iptables-services"
    – qris
    Jan 4, 2015 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .