Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using ArchLinux and I have an IP tables rule that I know works (from my other server), and it's in /etc/iptables/iptables.rules, it's the only rule set in that directory. I run, /etc/rc.d/iptables save, then /etc/rc.d/iptables/restart, but when I do "iptables --list", I get ACCEPTs on INPUT,FORWARD & OUTPUT.

# Generated by iptables-save v1.4.8 on Sat Jan  8 18:42:50 2011
:OUTPUT ACCEPT [216:14865]
:interfaces - [0:0]
:open - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 18 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 17 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 10 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 9 -j DROP 
-A INPUT -p icmp -m icmp --icmp-type 5 -j DROP 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -j interfaces 
-A INPUT -j open 
-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A INPUT -f -j DROP 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP 
-A INPUT -i eth+ -p icmp -m icmp --icmp-type 8 -j DROP 
-A BRUTEGUARD -m recent --set --name BF --rsource 
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j LOG --log-prefix "[BRUTEFORCE ATTEMPT] " --log-level 6 
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j DROP 
-A interfaces -i lo -j ACCEPT 
-A open -p tcp -m tcp --dport 80 -j ACCEPT 
-A open -p tcp -m tcp --dport 10011 -j ACCEPT 
-A open -p udp -m udp --dport 9987 -j ACCEPT 
-A open -p tcp -m tcp --dport 30033 -j ACCEPT 
-A open -p tcp -m tcp --dport 8000 -j ACCEPT 
-A open -p tcp -m tcp --dport 8001 -j ACCEPT 
-A open -s -p tcp -m tcp --dport 21 -j ACCEPT 
-A open -s -p tcp -m tcp --dport 3306 -j ACCEPT 
-A open -p tcp -m tcp --dport 22 -j BRUTEGUARD 
-A open -s -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
# Completed on Sat Jan  8 18:42:50 2011
share|improve this question
up vote 1 down vote accepted

I didn't see the exact save method, so make sure you are doing this:

iptables-save > /etc/iptables/iptables.rules

Then restart and it should keep whatever rules you created before the save.

Also the file I use to save rules is different, I'm not sure about ArchLinux, but in Ubuntu its here:


One other question to ask is there anything else running that would modify iptables? e.g. Shorewall

share|improve this answer
Thanks so much man. It wasn't exactly that, it was < instead of >, but it worked. – ArchUser Jan 10 '11 at 16:54
cool good to hear its working for ya – nictrix Jan 15 '11 at 14:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.