5

Will website be stopped during an iptables restart by the following command in a CentOS 6 system?

$ service iptables restart
14

By default, no. The /etc/init.d/iptables script does the following on restart:

restart() {
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
}

Notwithstanding the issue of saving the existing rules, the effect of an unmodified stop is to disable all the rules:

[root@bill ~]# service iptables stop
iptables: Setting chains to policy ACCEPT: mangle nat filte[  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
[root@bill ~]# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

And assuming that either (a) you're saving the rules on stop, and your existing rules are what you want, or (b) you don't save the rules on stop, and your proposed ruleset in /etc/sysconfig/iptables is syntactically and functionally correct, when the start puts the rules back in place, service should continue uninterrupted.

The state table is not affected by stopping the firewall rules, so any traffic that was being allowed through by stateful rules before the stop should continue to be so after the start. NAT rules do get (temporarily) erased by a stop, though, so if you're using NAT then that may be affected by a restart.

2
  • Even if the chains were set to DROP, the restart would usually be fast enough for clients to simply assume that their SYN got lost due to arbitrary reasons and retry quickly, without the user (or even application) seeing anything except a slightly longer connection attempt. REJECT would be a different matter. – Jonas Schäfer Sep 26 '16 at 17:52
  • @JonasWielicki yes, I agree. – MadHatter Sep 26 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.