Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Normally (that is, on Debianish systems), when you have to add a firewall rule uou have to put a defenition in the iptables.d/ directory and restart iptables. I can easily write a script to do this on a few systems (for example with expect, or something like that).

On Redhat systems, they "forgot" the iptables.d/ directory, and you have to put the new rule in /etc/sysconfig/iptables. I can certainly device a sed and awk thingy that puts the rule in the file (the last rule is a reject rule, and everything beyond that is ignored, so you have to add the rule "in the middle" of the file). but these things often quickly get messy.

Question: is there a way to maintain the iptables rules of many Redhat Servers, such that you don;t need "hacking the file" with awk/sed ? I am looking for easy implementations, not something big like Satelite or JBoss-ON (RHQ).

share|improve this question

Unless I'm missing the point to your question, it would seem to be that all you need to do is add the rule with the appropriate iptables -A or iptables -I command and then do an iptables-save > /etc/sysconfig/iptables to retain the current rule set across reboots.

share|improve this answer
+1, and service iptables save will do the trick, too. – Aaron Copley Feb 9 '12 at 0:30

If I understand correctly, you have misunderstanding of how iptables works.

Firewall rules are loaded into memory and are being used by netfilter - the kernel network facility. iptables - is just a command line tool that can access netfilter rules and modify them. Once you have set your firewall correctly you can just

/etc/init.d/iptables save

And system will save firewall state to harddrive. On boot system will restore these settings. I.e. you don't need to prepare any firewall initialization script, this is really old way of doing things.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .