Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I usually run my iptables rules whenever I login. From the terminal I type ;

sudo sh

Setting up my sister's computer, I want to give her some basic firewall protection. She wont be logging in as admin, just a standard account. How can I make a firewall script run everytime she logs in without her having to type in any password?

The script I wrote for my sister's computer contains ;


modprobe ip_conntrack
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -I OUTPUT -p tcp --dport 80 --sport 32768:61000 -j ACCEPT
iptables -I OUTPUT -p udp --dport 53 --sport 32768:61000 -j ACCEPT
iptables -I OUTPUT -p tcp --dport 443 --sport 32768:61000 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -I OUTPUT -p icmp -j DROP

iptables -I INPUT -p icmp -j DROP
iptables -I INPUT -p udp -j DROP
iptables -I INPUT -p tcp -m tcp --syn -j DROP
iptables -I INPUT -i lo -j ACCEPT
iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

I've placed it in her home folder as and set it to be executable (right click on the file, and checking the "allow executing file as program" option in the permissions tab).

Running this script from the terminal as root works fine.

After typing ;

sudo sh

I typed into the terminal

sudo iptables -L -v

and I get

Chain INPUT (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN
    0     0 DROP       udp  --  any    any     anywhere             anywhere            
    0     0 DROP       icmp --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       icmp --  any    any     anywhere             anywhere            
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spts:32768:61000 dpt:https
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp spts:32768:61000 dpt:domain
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spts:32768:61000 dpt:http
    0     0 ACCEPT     all  --  any    lo      anywhere             anywhere

How can I have this this script run automatically at login, or possibly save these rules permanently for my sisters computer? Could you please provide some detailed code, as my first attempts at rc.local method and iptables-save have not been very successful. On every reboot, all INPUT, OUTPUT and FORWARD chains are reset to ACCEPT, with no policies listed when I type sudo iptables -L -v

share|improve this question
Almost two years later, but an important comment: make sure that you have ip6tables rules if you get v6 connectivity one day, since IPv6 is handled by ip6tables and not iptables. – Thomas Ward Apr 5 '15 at 13:02
up vote 18 down vote accepted

You may want to use the iptables-persistent package rather than mess with your boot scripts. First, run your script to set up the firewall rules. Secondly, run sudo apt-get install iptables-persistent, and follow the prompts. When it asks to save the current rules, hit "Yes" at both prompts. Now, on reboots, your iptables rules will be restored.

NOTE: If you change your rules after this, you will need to do the following command(s) after the changes:

To save your IPv4 iptables rules: sudo su -c 'iptables-save > /etc/iptables/rules.v4'

To save your IPv6 ip6tables rules: sudo su -c 'ip6tables-save > /etc/iptables/rules.v6'

share|improve this answer
Thank You, that worked. If I do want to temporarily change the rules, I can just run a script from the terminal yes? – Mikelane Mar 21 '13 at 4:34
Yes, or you can directly manipulate the iptables system directly. HOWEVER, if you plan on using the temporary rule persistently, the new rule(s) aren't guaranteed to be saved unless you do the commands I state in my answer. – Thomas Ward Mar 21 '13 at 4:38
Is it a bad idea to run sudo dpkg-reconfigure iptables-persistent after changing a rule. – souravc Jun 16 '15 at 3:29
@souravc the question that responds to that is "Why would you need or want to?" The idea is that you wouldn't have to and can just rewrite (or overwrite( the rules.v4 or rules.v6 files manually so they get indexed at next boot, or immediately if you run iptables-restore < /etc/iptables/rules.v4 or ip6tables-restore < /etc/iptables/rules.v6 – Thomas Ward Jun 16 '15 at 5:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.