Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm using CentOS. What I'm wondering is, what happens if I manually edit /etc/sysconfig/iptables and save it? Is that the definitive source? When I type iptables -L I get something that doesn't match the contents of that file. Is there a way I can just edit the chains directly without adding/removing rules one at a time? i.e. open VIM and get everything set up the way I want it and then save.

Along those lines, when I do something like iptables -A INPUT , where does that go in the immediate sense? Is it not applied until I do an iptables-save? I feel like I'm just missing an a-ha moment here and I can't seem to find the answer in a search.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

iptables-save >//iptables.save

Find the iptables.save file and update it with the file from above.

Restore your config file: iptables-restore /iptables.save

I added the restore command to my run on start up cron task and everything is fine.

iptables -A INPUT

As you guessed it is not saved unless you save it. The command only goes in memory and is active. You have specified the "INPUT" chain so your rule goes there. The rule is placed last in the "INPUT" chain. If you forgot to save it is gone upon reboot.

share|improve this answer
2  
To build upon this, iptables -L is the definitive source. It is wiped upon every restart. If you want to make it persist, then you must use iptables-save > filename to save it after making changes, and configure the system to iptables-restore < filename every time the system boots up. If you don't like operating on iptables directly, then edit filename and manually run iptables-restore < filename when you're done. –  Darth Android Jun 27 '13 at 16:17
    
Ok, thanks...this helps. So what's the purpose of /etc/sysconfig/iptables? I think that's where I'm getting confused. –  JamesB41 Jun 27 '13 at 16:44
1  
/etc/sysconfig/iptables is read by the init script iptables. Essentially that startup script does iptables-restore </etc/sysconfig/iptables. –  Ciclamino Jun 27 '13 at 20:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.