0

I've installed iptables-persistent (Ubuntu 14.04) with the impression that it automatically saves iptables on shutdown but that appears not to be the case? It seem to load saved rules at startup but unless I save them beforehand (service iptables-persistent save) they are loaded from an older ruleset.

Am I doing something wrong or is this the way the iptables-persistent package is meant to behave?

Is there a recommended method of keeping /etc/iptables/rules.v4 current so that it is always up to date in the event of an unexpected power outage, or in case I restart and forget to save the rules?

I've considered using a cron script but really not sure if I am simply misunderstanding or have something configured wrong.

2

By default, Ubuntu uses ufw. You are going to be best off using ufw to configure iptables.

If you wish to use iptables directly, you can the use iptable-persistent, but you must save your rules first.

I believe this command will help:

sudo bash -c "iptables-save > /etc/iptables/rules"

You can do this without installing iptables-persistent :

Other examples:

  • sorry that doesn't really answer my question. i'm not having any problem configuring iptables.. just want to know best method to make they are saved to /etc/iptables/rules.v4 and /etc/iptables/rules.v6 on shutdown (and really anytime iptables are updated) in case of restart. i know how to manually save them... just want something that does this automatically. – billynoah Jul 6 '14 at 5:34
  • I am not aware of any tool to do what you want in Ubuntu. This is because ubuntu uses ufw. if you use ufw, rather then iptables, your rules will be saved. otherwise, if you want to use iptables, you will have to use one of the suggestions from my links or script it yourself. – Panther Jul 6 '14 at 12:22
  • i'm using fail2ban and iptables. at this point i'm going with this guy's solution: looke.ch/wp/list-based-permanent-bans-with-fail2ban as it allows relatively easy management of banned ips, and since iptables-persistent seems to conflict a bit with fail2ban. – billynoah Jul 6 '14 at 16:28
  • OK, well glad you found a solution. – Panther Jul 6 '14 at 18:15
1

You are correct that the iptables-persistent package does not automatically save your rules for you on shutdown. This can help prevent being locked out of a remote system.

/usr/share/doc/iptables-persistent/README:

The Debian Package iptables-persistent
----------------------------

This is a very simple script that restores the file /etc/iptables/rules.v4 as
the active ruleset at system boot.

If it exists, IPv6 rules are also restored from /etc/iptables/rules.v6

Loading of rules is guaranteed to happen before network interfaces are
brought up.

To save the current ruleset, use "iptables-save >/etc/iptables/rules.v4"
or "ip6tables-save >/etc/iptables/rules.v6", or
"invoke-rc.d iptables-persistent save"

 -- Simon Richter <sjr@debian.org>  Wed, 01 Jul 2009 13:43:43 +0200
 -- Jonathan Wiltshire <jmw@debian.org>  Thu, 30 Dec 2010 00:00:00 +0000

When the iptables-persistent package is first installed, it asks you if you want to save your current configuration. I believe you can also trigger this with sudo dpkg-reconfigure iptables-persistent.

0

Recent versions of iptables-persistent save the state of rules once at configuration time, rather than repeatedly at every reboot. It appears that this used to work differently...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.