0

I'm using Ubuntu 14.04 as a firewall with iptables.

I have a network interface like this:

iface lo inet loopback
        pre-up iptables-restore < /etc/iptables.rules

This method has been working for years, but not anymore. My firewall is up to date. I also enabled logging:

iface lo inet loopback
        pre-up iptables-restore < /etc/iptables.rules > /var/log/iptables-boot.log

but it's empty.

I also tried it with a script at /etc/network/if-up.d/script:

#!/bin/sh
iptables-restore < /etc/iptables.rules >> /var/log/iptables_boot.log
echo "iptables loaded" >> /var/log/iptables_boot.log

Where, the logfile only contains "iptables loaded" but nothing else. That means the script runs, but no iptables rules are added to the kernel.

Any ideas?

thanks!

Improve this question
1
  • When asking about iptables, it is helpful if you post your rules ;)
    – Panther
    Sep 22, 2015 at 18:03

1 Answer 1

Reset to default
0

I am not sure why your iptables configuration is not loading. It could be because you are using domain names, rather then ip address

IMO easiest "solution" is to use iptables-persistent

First, configure or load your rules (you will be asked to save the current set of rules as a part of the install)

Then run

sudo apt-get -y install iptables-persistent

For additional information, including modifying your rules in the future, See http://www.microhowto.info/howto/make_the_configuration_of_iptables_persistent_on_debian.html

and (for ip address vs. domain name)

iptables-persistent doesn't load rules on boot

Improve this answer
6
  • Hi, yes I've found 'iptables-persistent' but I think it is a workaround. I'd like to know why this happens. How can I debug this loading? I don't use hostnames in iptables, only IP addresses!
    – blueboi69
    Sep 22, 2015 at 18:41
  • If you need help, post your iptables rules, otherwise it is next to impossible to guess. Could be askubuntu.com/questions/246578/… for all I know ;) iptables-persistent is not really a "work around" as ubuntu uses ufw, and not iptables by default. iptables-persistent is the default way Debian/Ubuntu saves iptables rules by default (it is not installed as ufw is preferred). rpm systems use alternate methods.
    – Panther
    Sep 22, 2015 at 18:46
  • I really don't want to post my iptables rules as there are about 1200lines. nobody would read it. If I run the "iptables-restore < /etc/iptables.rules" command, then it works fine and loads all the rules from the file. This means to me that there is no problem with the rules.
    – blueboi69
    Sep 22, 2015 at 19:01
  • Is there something that could reset the iptables rules? I have a thought that the rules are loaded, but after that, they are being flushed. What do you think?
    – blueboi69
    Sep 23, 2015 at 12:02
  • pastebin your rule set and post a link back here if you need help. 1200 lines sounds excessive and there is likely a way of simplifying your rules. My other guess is that you are using domain names rather then ip addresses.I am guessing you are blocking certain sites and iptables ls likely not the best tool, but hard to say. See also bodhizazen.net/Tutorials/iptables
    – Panther
    Sep 23, 2015 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .