0

To clear all rules in iptables I use this

#!/bin/bash
echo "clearing iptables ... "
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

This works so far as there are no entries in iptables any more, which is checked with

sudo iptables -L

or

sudo iptables -S

However, traffic that has been forwarded to a different target still is beeing routed to that target.

That seems like the cleared iptables still are active after clearing them!

Up to now my only way to get rid of those rules is to reboot the system which is not very elegant.

In Debian iptables doesn't seem to run as a service so start or stop of that service doesn't work.

How do I totally clear or reset iptables with the effect that previously defined rules are deactivated?

0
sudo ufw status verbose; sudo iptables -L; 

Maybe there is ufw running on? Try to stop.

Could you tell a littlem bit more about your system, network and which traffic is still routed?

1-2 examples are ok incl. the initial firewall rule.

EDIT:

Checked by some of my scripts..... Also flush the chains.

sudo iptables -F INPUT
sudo iptables -F FORWARD 
sudo iptables -F OUTPUT
6
  • ufw is not installed on my system (command not found). I've also flushed the chains as indicated, but still the forwarding is active. The rule that has been installed and then cleared: sudo iptables -t nat -A OUTPUT -p udp -d 192.168.178.10 --dport 4000 -j DNAT --to-destination 192.168.178.22:4000 – Sören Jul 24 '19 at 7:52
  • Mmmmh could it be, that just active connections are still routet? – MWE Jul 24 '19 at 7:53
  • What would be an active connection? UDP isn't connection oriented, or is it? The UDP packets are generated by an application on the same machine where the iptables are running. The rules are used to redirect the UDP packets to a different destination. – Sören Jul 24 '19 at 8:03
  • And destination isn't reachable without this iptables rule? – MWE Jul 24 '19 at 8:16
  • No. The application that generates the UDP packets has the destination IP hard coded. The iptables are used to forward the UDP data to a different destination in the local network. – Sören Jul 24 '19 at 8:19
0

Your script to clear iptables rules is enough to flush and all rules and set default policy to ACCEPT. This effectively disables the firewall as there are no rules and everything is allowed.

We know, from your comments, you are sending UDP packets. You can feel like the old rules are still active for a while especially when there is a continuous stream of UDP packets going through your firewall machine. This is mainly because UDP does not have a way to close the connection and so the firewall does not know when the current active flow has finished. The only way is to use an idle timeout to flush active "connections" when there is no more packets seen.

You have two options:

  1. Wait for some time before trying again. This requires to stop any current active "connections". You can find UDP timeout in /proc/sys/net/netfilter/nf_conntrack_udp_timeout.
  2. Use conntrack tool to delete the existing "connections" manually.

Please, note that Linux firewall keeps track of active sockets for TCP/UDP even if UDP is a connection-less protocol.

2
  • /proc/sys/net/netfilter/nf_conntrack_udp_timeout shows a value of 30 which probably means 30 seconds. So I need to stop the application that generates the UDP data for 30 seconds and then restart it. I'll check this in a minute... – Sören Jul 24 '19 at 8:52
  • Stopped the application, waited for 2 minutes, restarted the application. The cleared rules still was active and redirected the UDP data. So I need to look into conntrack next. – Sören Jul 24 '19 at 9:30
0
  1. The flushing of the iptables rules doesn't affect on already established connections those has been redirected with DNAT. It's related because the conntrack entry for UDP packets contains the redirecting information, that is used aside the iptables rules.

  2. Check the existed conntrack entries with the conntrack -L and monitor the conntrack events with the conntrack -E command.

  3. Use the conntrack -F command to clear the conntrack entries. The new UDP packets won't be redirected anymore.

  4. To manage the iptables rules as service use the netfilter-persistent and iptables-persistent packages.

  5. Better use iptables-save/iptables-restore commands instead manual run of the iptables. It's more safe and atomic.

  6. For manage the iptables rules on a remote host use the iptables-apply command, that allow rollback the rule set if it hasn't been confirmed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.