Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have some iptables rules and a policy that I want to apply to my desktop. Where is the the configuration file that will make these changes permanent?

Is there any issues with using iptables and NetworkManager?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

NetworkManager has nothing to do with iptables, although you may run into issues if you're using other firewalling software like ufw. The default ruleset that is applied by iptables-apply is /etc/network/iptables, so let's use that one.

The rules file looks like:

*FILTER

# filter rules here, example below:

# Reject incoming packets by default
:INPUT REJECT

# example of established packets: you request askubuntu.com and a response is
# send back to TCP port 80
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow traffic to the loopback adapter ("localhost")
-A INPUT -i lo -j ACCEPT

COMMIT

Note that a newline after COMMIT is mandatory, without it the file won't load correctly. If you wish to see your current ruleset, run sudo iptables-save to output the rules to standard output.

Now create the executable /etc/network/if-pre-up.d/iptables file to load the rules on startup:

#!/bin/sh
/sbin/iptables-restore < /etc/network/iptables

Do note that if you apply rules during a session (read: before the machine is shutdown/ rebooted), these will be lost on shutdown. If you wish to keep such rules, create another script for saving the rules. Note that comments and such are lost.

/etc/network/if-pre-down.d:

#!/bin/sh
/sbin/iptables-save > /etc/network/iptables
share|improve this answer
    
... We need to manually make the iptables read the rules at startup...? Quiet different from RedHat. (Attended some sysadmin courses for RHCE). What about policy, how do we implement those? –  Oxwivi Oct 2 '11 at 11:08
    
IIRC RH reads the rules within an initscript too (/etc/init.d/iptables) and so does ufw (/etc/init/ufw.conf). Using iptables-restore (or iptables-apply when testing rules over SSH) is recommended over setting rules manually with the iptables command because if one rule fails to load, none will be loaded and thus preventing possibly locking yourself out. What do you mean by policy? /etc/network/iptables is the way to go for IPv4 rules for iptables, /etc/network/ip6tables for IPv6. –  Lekensteyn Oct 2 '11 at 21:00
    
Policy is the default firewall behavior, similar to the :UNPUT REJCT line. If you issue iptables -L, you'll see that Chain * has (policy ACCEPT) on the left. –  Oxwivi Oct 3 '11 at 6:03
    
By the way, if I learned anything right in the course, all the packets will be rejected before being allowed to got lo in your example. The packets are filtered by the topmost rules first, only moves down, if the earlier rule did not filter it. –  Oxwivi Oct 3 '11 at 6:05
1  
Ah, so :INPUT REJECT is the policy. Thanks! –  Oxwivi Oct 3 '11 at 12:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.