I am setting up iptables on a new instance of Ubuntu 14.04 server.
So far I have:

  • put iptables rules into a file /etc/iptables.firewall.rules
  • created a script /etc/network/if-pre-up.d/iptablesload.sh and put the following code in it
iptables-restore < /etc/iptables.firewall.rules
exit 0

The firewall rules work, e.g. if I manualy run the command from a prompt

$ iptables-restore < /etc/iptables.firewall.rules

the iptables rules get applied. But when I reboot the server the firewall is not up - how can I fix this?

  • I suggest you use the full path to binaries, /sbin/iptables-restore – Panther Nov 6 '15 at 12:37

Your method is the hackish method.

You should consider installing the iptables-persistent package which automatically will handle loading up of iptables rules at boot.

This will store rules in /etc/iptables/rules.v4 and /etc/iptables/rules.v6 and will load at boot. Make revisions to those files and restore from those if you edit your rule sets.

  • thanks. I'm trying your suggestion now. will post back with the outcome – the_velour_fog Nov 6 '15 at 12:14
  • @user4668401 You're welcome. I always advise against trying to home-grow a solution when an easy one exists in the repositories ;) – Thomas Ward Nov 6 '15 at 12:35
  • 1
    This is the probably the easiest solution. FWIW, for the vast majority of users ufw may be a better solution. If you are familiar with iptables it is trivial to learn and the rule set is maintained by a team of security experts rather then everyone writing his or her own rules. help.ubuntu.com/community/UFW – Panther Nov 6 '15 at 12:36
  • @bodhi.zazen agreed with you, but given OP said they were setting up iptables... I chose to ignore ufw in this case :P – Thomas Ward Nov 6 '15 at 12:37
  • 1
    limiting connections makes the black hats go away faster and automatically. The automated ssh scans move on fairly fast for example and rate limits on http help as well, but the parameters for http are much more liberal then ssh. – Panther Nov 6 '15 at 13:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.