I used to have my own set of iptables rules on my Ubuntu 14.04 LTS installation. This was residing in /etc/network/if-pre-up.d/iptables.

Now, apparently after another apt-get dist-upgrade it looks like my rules are overridden: when I run iptables -L I see stuff which seems to be originating from libvirt or something else but not me.

I am therefore looking for a way to find out where those rules come from so that I could edit/control them. The way I am after needs to be smarter than the one I am trying now — simply searching all system config files for unique strings appearing in the iptables -L output.


After running virsh net-autostart default --disable and rebooting all those weird iptables rules have gone. Now that I have clean iptables I know — they were previously polluted by libvirt/kvm.

Still, the question remains: is there a general way of finding out where iptables rules come from? Something more intelligent than guessing and turning stuff off one by one to see if it affects iptables?

  • Is it possible you now have UFW installed? It is a front-end to iptables and very commonly installed on Ubuntu. Jul 11, 2015 at 13:27
  • Nope, it was libvirt/kvm. See my update to the question.
    – Greendrake
    Jul 11, 2015 at 13:44

2 Answers 2


Generally iptables rules are saved or loaded by scripts residing in /etc/init.d. Assuming the scripts are using the typical iptables-save and iptables-restore commands, you could search for them with a recursive grep, for example:

grep -R iptables-restore /etc/init.d/

If the grep command output reveals any files, you can see what package was responsible for placing those files on the system.

dpkg-query -S file-name-result-of-grep

There is a chance that the file was either generated at install time or created by a regular user, if that's the case, then dpkg may not know about the file.

If the single-package-name terse output from dpkg isn't descriptive enough, you can apt-cache show package-name on the name of the package provided by dpkg.

  • But does that answer the question who put them there?
    – Seth
    Jul 12, 2015 at 4:56
  • 1
    What do you mean by whom? The responsible package? dpkg-query -S file-name-result-of-grep
    – Stephen
    Jul 12, 2015 at 22:51
  • The question is asking how to tell who or what created the rules. If that requires the dpkg command you should probably edit your answer to include that
    – Seth
    Jul 12, 2015 at 22:55
  • I didn't see the who part, just the where part, hence the comment above. I suppose it's really just more info on the where part, so I'll update the answer.
    – Stephen
    Jul 12, 2015 at 23:11
  • Thanks Stephen, that's indeed a good search start point. However it is still "try and see there" method rather than "trace and find". In my case the iptables rules were controlled by libvirt in this manner which does not have anything to do with the scripts in /etc/init.d. Perhaps the answer to be ticked would involve tracing iptables insert/modify calls or something like that.
    – Greendrake
    Jul 13, 2015 at 1:38

I believe the resulting iptables rules come from /var/lib/libvirt/network/default.xml which in turn is generated from /etc/libvirt/qemu/networks/default.xml when virsh net-edit default is used to make changes. I think, but am not sure, the rules are not stored as a rule set, but rather compiled from the .xml source and entered into the iptables rule set when libvirtd is started during boot.

  • That's right. The question is more general, though, rather than just about the source of libvirt rules. Perhaps the answer to be ticked would involve tracing iptables insert/modify calls or something like that.
    – Greendrake
    Jul 13, 2015 at 1:29
  • Oh. I use the /etc/network/interfaces file method for loading my iptables rule set via a pre-up directive (I think some users use a post-up directive). Jul 13, 2015 at 1:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .