Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using CentOS. What I'm wondering is, what happens if I manually edit /etc/sysconfig/iptables and save it? Is that the definitive source? When I type iptables -L I get something that doesn't match the contents of that file. Is there a way I can just edit the chains directly without adding/removing rules one at a time? i.e. open VIM and get everything set up the way I want it and then save.

Along those lines, when I do something like iptables -A INPUT , where does that go in the immediate sense? Is it not applied until I do an iptables-save? I feel like I'm just missing an a-ha moment here and I can't seem to find the answer in a search.

share|improve this question
up vote 0 down vote accepted

iptables-save >//

Find the file and update it with the file from above.

Restore your config file: iptables-restore /

I added the restore command to my run on start up cron task and everything is fine.

iptables -A INPUT

As you guessed it is not saved unless you save it. The command only goes in memory and is active. You have specified the "INPUT" chain so your rule goes there. The rule is placed last in the "INPUT" chain. If you forgot to save it is gone upon reboot.

share|improve this answer
To build upon this, iptables -L is the definitive source. It is wiped upon every restart. If you want to make it persist, then you must use iptables-save > filename to save it after making changes, and configure the system to iptables-restore < filename every time the system boots up. If you don't like operating on iptables directly, then edit filename and manually run iptables-restore < filename when you're done. – Darth Android Jun 27 '13 at 16:17
Ok, thanks...this helps. So what's the purpose of /etc/sysconfig/iptables? I think that's where I'm getting confused. – JamesB41 Jun 27 '13 at 16:44
/etc/sysconfig/iptables is read by the init script iptables. Essentially that startup script does iptables-restore </etc/sysconfig/iptables. – Ciclamino Jun 27 '13 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .