Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using ArchLinux and I have an IP tables rule that I know works (from my other server), and it's in /etc/iptables/iptables.rules, it's the only rule set in that directory. I run, /etc/rc.d/iptables save, then /etc/rc.d/iptables/restart, but when I do "iptables --list", I get ACCEPTs on INPUT,FORWARD & OUTPUT.

# Generated by iptables-save v1.4.8 on Sat Jan  8 18:42:50 2011
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [216:14865]
:BRUTEGUARD - [0:0]
:interfaces - [0:0]
:open - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 18 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 17 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 10 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 9 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 5 -j DROP 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -j interfaces 
-A INPUT -j open 
-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A INPUT -f -j DROP 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP 
-A INPUT -i eth+ -p icmp -m icmp --icmp-type 8 -j DROP 
-A BRUTEGUARD -m recent --set --name BF --rsource 
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j LOG --log-prefix "[BRUTEFORCE ATTEMPT] " --log-level 6 
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j DROP 
-A interfaces -i lo -j ACCEPT 
-A open -p tcp -m tcp --dport 80 -j ACCEPT 
-A open -p tcp -m tcp --dport 10011 -j ACCEPT 
-A open -p udp -m udp --dport 9987 -j ACCEPT 
-A open -p tcp -m tcp --dport 30033 -j ACCEPT 
-A open -p tcp -m tcp --dport 8000 -j ACCEPT 
-A open -p tcp -m tcp --dport 8001 -j ACCEPT 
-A open -s 76.119.125.61 -p tcp -m tcp --dport 21 -j ACCEPT 
-A open -s 76.119.125.61 -p tcp -m tcp --dport 3306 -j ACCEPT 
-A open -p tcp -m tcp --dport 22 -j BRUTEGUARD 
-A open -s 76.119.125.61 -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
COMMIT
# Completed on Sat Jan  8 18:42:50 2011
share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

I didn't see the exact save method, so make sure you are doing this:

iptables-save > /etc/iptables/iptables.rules

Then restart and it should keep whatever rules you created before the save.

Also the file I use to save rules is different, I'm not sure about ArchLinux, but in Ubuntu its here:

/etc/iptables.rules

One other question to ask is there anything else running that would modify iptables? e.g. Shorewall

share|improve this answer
    
Thanks so much man. It wasn't exactly that, it was < instead of >, but it worked. –  ArchUser Jan 10 '11 at 16:54
    
cool good to hear its working for ya –  nictrix Jan 15 '11 at 14:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.