1

Long ago I created some prerouting rules in my iptables. I have a script in ~/myuser/Downlaods, owned by root

 #!/bin/bash
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT  --to-port 8069
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT  --to-port 8070
iptables-save

I have commented out these lines and renamed the file and changed ownership to a non-root user.

I think I must have added it to some other script (rc.local, systemd,etc...) because after I clear the iptables, save them and reboot, the rules come back.

I have tried:

$ sudo iptables -t nat -D PREROUTING 2
$ sudo iptables -t nat -D PREROUTING 1
$ sudo iptables-save

And this works temporarily. At this point the iptables are all empty. Then I reboot:

$ sudo reboot

After the reboot I get: $ sudo iptables -L -n -t nat

Chain PREROUTING (policy ACCEPT)
target    prot opt source    destination
REDIRECT  tcp  --  0.0.0.0/0 0.0.0.0/0   tcp dpt:80 redir ports 8069
REDIRECT  tcp  --  0.0.0.0/0 0.0.0.0/0   tcp dpt:443 redir ports 8070

The other chains are empty.

I set systemd log level to DEBUG in the config file, and while there are thousands of lines for the boot, I don't see anything (mainly using grep) that refers to iptables or PREROUTING.

I'm running Ubuntu 18.04.1 LTS.

I ran $ sudo grep -rnw 'etc/init.d/' -e 'PREROUTING' and it didn't return any results.

I ran $ sudo grep -rnw 'etc/init.d/' -e '8069' and it didn't return any results.

/etc/rc.local does not exist, so it's not running from there.

Where else can I look for this?

  • Install netfilter-persistent then remove those rules and run sudo dpkg-reconfigure iptables-persistent – George Udosen Dec 4 '18 at 20:52
  • @GeorgeUdosen that worked. Thanks. If you put that in as an answer, I'll accept it. – user3347569 Dec 4 '18 at 21:03
  • Ok I have posted an answer! – George Udosen Dec 4 '18 at 21:16
1

To fix your situation install netfilter-persistent and then proceed to remove those rules again with your previous commands.

Now to get iptables to reload and be duly informed of the new state of iptables rules you either do:

sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6 # for ipv6

Or:

sudo dpkg-reconfigure iptables-persistent

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.