Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using ArchLinux and I have an IP tables rule that I know works (from my other server), and it's in /etc/iptables/iptables.rules, it's the only rule set in that directory. I run, /etc/rc.d/iptables save, then /etc/rc.d/iptables/restart, but when I do "iptables --list", I get ACCEPTs on INPUT,FORWARD & OUTPUT.

# Generated by iptables-save v1.4.8 on Sat Jan  8 18:42:50 2011
:OUTPUT ACCEPT [216:14865]
:interfaces - [0:0]
:open - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 18 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 17 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 10 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 9 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 5 -j DROP 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -j interfaces 
-A INPUT -j open 
-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A INPUT -f -j DROP 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP 
-A INPUT -i eth+ -p icmp -m icmp --icmp-type 8 -j DROP 
-A BRUTEGUARD -m recent --set --name BF --rsource 
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j LOG --log-prefix "[BRUTEFORCE ATTEMPT] " --log-level 6 
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j DROP 
-A interfaces -i lo -j ACCEPT 
-A open -p tcp -m tcp --dport 80 -j ACCEPT 
-A open -p tcp -m tcp --dport 10011 -j ACCEPT 
-A open -p udp -m udp --dport 9987 -j ACCEPT 
-A open -p tcp -m tcp --dport 30033 -j ACCEPT 
-A open -p tcp -m tcp --dport 8000 -j ACCEPT 
-A open -p tcp -m tcp --dport 8001 -j ACCEPT 
-A open -s -p tcp -m tcp --dport 21 -j ACCEPT 
-A open -s -p tcp -m tcp --dport 3306 -j ACCEPT 
-A open -p tcp -m tcp --dport 22 -j BRUTEGUARD 
-A open -s -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
# Completed on Sat Jan  8 18:42:50 2011
share|improve this question
up vote 1 down vote accepted

I didn't see the exact save method, so make sure you are doing this:

iptables-save > /etc/iptables/iptables.rules

Then restart and it should keep whatever rules you created before the save.

Also the file I use to save rules is different, I'm not sure about ArchLinux, but in Ubuntu its here:


One other question to ask is there anything else running that would modify iptables? e.g. Shorewall

share|improve this answer
Thanks so much man. It wasn't exactly that, it was < instead of >, but it worked. – ArchUser Jan 10 '11 at 16:54
cool good to hear its working for ya – nictrix Jan 15 '11 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .