I usually run my iptables rules whenever I login. From the terminal I type ;

sudo sh firewall.sh

Setting up my sister's computer, I want to give her some basic firewall protection. She wont be logging in as admin, just a standard account. How can I make a firewall script run everytime she logs in without her having to type in any password?

The script I wrote for my sister's computer contains ;


modprobe ip_conntrack
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -I OUTPUT -p tcp --dport 80 --sport 32768:61000 -j ACCEPT
iptables -I OUTPUT -p udp --dport 53 --sport 32768:61000 -j ACCEPT
iptables -I OUTPUT -p tcp --dport 443 --sport 32768:61000 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -I OUTPUT -p icmp -j DROP

iptables -I INPUT -p icmp -j DROP
iptables -I INPUT -p udp -j DROP
iptables -I INPUT -p tcp -m tcp --syn -j DROP
iptables -I INPUT -i lo -j ACCEPT
iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

I've placed it in her home folder as firewall.sh and set it to be executable (right click on the file, and checking the "allow executing file as program" option in the permissions tab).

Running this script from the terminal as root works fine.

After typing ;

sudo sh firewall.sh

I typed into the terminal

sudo iptables -L -v

and I get

Chain INPUT (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcpflags: FIN,SYN,RST,ACK/SYN
    0     0 DROP       udp  --  any    any     anywhere             anywhere            
    0     0 DROP       icmp --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       icmp --  any    any     anywhere             anywhere            
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spts:32768:61000 dpt:https
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp spts:32768:61000 dpt:domain
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spts:32768:61000 dpt:http
    0     0 ACCEPT     all  --  any    lo      anywhere             anywhere

How can I have this this script run automatically at login, or possibly save these rules permanently for my sisters computer? Could you please provide some detailed code, as my first attempts at rc.local method and iptables-save have not been very successful. On every reboot, all INPUT, OUTPUT and FORWARD chains are reset to ACCEPT, with no policies listed when I type sudo iptables -L -v

  • 1
    Almost two years later, but an important comment: make sure that you have ip6tables rules if you get v6 connectivity one day, since IPv6 is handled by ip6tables and not iptables.
    – Thomas Ward
    Apr 5, 2015 at 13:02

2 Answers 2


You may want to use the iptables-persistent package rather than mess with your boot scripts. First, run your script to set up the firewall rules. Secondly, run sudo apt-get install iptables-persistent, and follow the prompts. When it asks to save the current rules, hit "Yes" at both prompts. Now, on reboots, your iptables rules will be restored.

NOTE: If you change your rules after this, you will need to do the following command(s) after the changes:

To save your IPv4 iptables rules: sudo su -c 'iptables-save > /etc/iptables/rules.v4'

To save your IPv6 ip6tables rules: sudo su -c 'ip6tables-save > /etc/iptables/rules.v6'

  • Thank You, that worked. If I do want to temporarily change the rules, I can just run a script from the terminal yes?
    – Mikelane
    Mar 21, 2013 at 4:34
  • Yes, or you can directly manipulate the iptables system directly. HOWEVER, if you plan on using the temporary rule persistently, the new rule(s) aren't guaranteed to be saved unless you do the commands I state in my answer.
    – Thomas Ward
    Mar 21, 2013 at 4:38
  • Is it a bad idea to run sudo dpkg-reconfigure iptables-persistent after changing a rule.
    – sourav c.
    Jun 16, 2015 at 3:29
  • 1
    @souravc the question that responds to that is "Why would you need or want to?" The idea is that you wouldn't have to and can just rewrite (or overwrite( the rules.v4 or rules.v6 files manually so they get indexed at next boot, or immediately if you run iptables-restore < /etc/iptables/rules.v4 or ip6tables-restore < /etc/iptables/rules.v6
    – Thomas Ward
    Jun 16, 2015 at 5:46

Assuming you have the firewall rules in:


Perhaps the most obvious answer will be to create a file called iptables in:


with the content:

/sbin/iptables-restore < /etc/iptables.up.rules

and make it executable using

sudo chmod +x /etc/network/if-pre-up.d/iptables

This way before your network interface is activated your rules will be loaded.

  • Thank you, does it throw log anywhere? This isn't working and I suspect this is due to my dns server used has a resolver not yet started when my host is booting. May 5, 2017 at 11:54
  • This also doesnt' work for me. I always thought this was the way but someone pointed out my firewall wasn't up.
    – chovy
    Dec 13, 2020 at 0:11
  • Have you tried to run it manually? sudo /sbin/iptables-restore < /etc/iptables.up.rules what was the resulting message? Dec 15, 2020 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.