How do I get ipTables rules to stick?

[TechBoyJK]

So I can add rules to ipTables via command line, but they don't stick upon reboot or restarting ipTables.

How do you guys make your rules stick? Do you just write a bash script that runs when the server boots up?

 

[Jodell88]

This should be default behaviour.

iptables-save > /etc/iptables/iptables.rules

 

[mv2devnull]

Depends on distro.

Redhat-style is/was that initscripts load rules atomically to kernel's netfilter from /etc/sysconfig/iptables (and similar IPv6 file) during boot. As shown by Jodell88, a command (iptables-save) reads current netfilter rules from kernel to stdout (and initscripts include an incantation: "service iptables save"). Recent Fedora have some daemonic replacement for the iptables tool.

 

[Red Squirrel]

I usually make a script called applyfirewallrules.sh and put it in /data/scripts/ (folders I make). I keep it all consistent on each machine so it's easy to know where stuff is no matter what distro.

I then just put the actual iptable commands in that script. Make sure it does a flush first though.

Did not know about the iptables-save command though, that might actually be a better route. Just be sure /etc is part of your backup job.

 

[KenJackson]

Redhat-style is/was that initscripts ... "service iptables save").
Recent Fedora have some daemonic replacement for the iptables tool.

I haven't changed my rules since systemctl rudely barged onto the scene, so the last time I save mine I used "service iptables save".

I just went looking for the systemctl equivalent. The equivalents for start and stop are implemented, but not save.

But I found the old init.d script here: /usr/libexec/iptables/iptables.init.

I wonder why the didn't add something like this line:
ExecSave=/usr/libexec/iptables/iptables.init save
to this file:
/usr/lib/systemd/system/iptables.service

If that was done, I think this would work: systemctl save iptables.service

 

[Jodell88]

I haven't changed my rules since systemctl rudely barged onto the scene, so the last time I save mine I used "service iptables save".

I just went looking for the systemctl equivalent. The equivalents for start and stop are implemented, but not save.

But I found the old init.d script here: /usr/libexec/iptables/iptables.init.

I wonder why the didn't add something like this line:
ExecSave=/usr/libexec/iptables/iptables.init save
to this file:
/usr/lib/systemd/system/iptables.service

If that was done, I think this would work: systemctl save iptables.service

I think you should look up SystemD on what it does and how it behaves.

 

[KenJackson]

I think you should look up SystemD on what it does and how it behaves.

Oh, I'm learning it. What secret are you alluding to?