0

I'm using CentOS. What I'm wondering is, what happens if I manually edit /etc/sysconfig/iptables and save it? Is that the definitive source? When I type iptables -L I get something that doesn't match the contents of that file. Is there a way I can just edit the chains directly without adding/removing rules one at a time? i.e. open VIM and get everything set up the way I want it and then save.

Along those lines, when I do something like iptables -A INPUT , where does that go in the immediate sense? Is it not applied until I do an iptables-save? I feel like I'm just missing an a-ha moment here and I can't seem to find the answer in a search.

Improve this question

1 Answer 1

Reset to default
0

iptables-save >//iptables.save

Find the iptables.save file and update it with the file from above.

Restore your config file: iptables-restore /iptables.save

I added the restore command to my run on start up cron task and everything is fine.

iptables -A INPUT

As you guessed it is not saved unless you save it. The command only goes in memory and is active. You have specified the "INPUT" chain so your rule goes there. The rule is placed last in the "INPUT" chain. If you forgot to save it is gone upon reboot.

Improve this answer
3
  • 2
    To build upon this, iptables -L is the definitive source. It is wiped upon every restart. If you want to make it persist, then you must use iptables-save > filename to save it after making changes, and configure the system to iptables-restore < filename every time the system boots up. If you don't like operating on iptables directly, then edit filename and manually run iptables-restore < filename when you're done.
    – Darth Android
    Jun 27, 2013 at 16:17
  • Ok, thanks...this helps. So what's the purpose of /etc/sysconfig/iptables? I think that's where I'm getting confused.
    – JamesB41
    Jun 27, 2013 at 16:44
  • 1
    /etc/sysconfig/iptables is read by the init script iptables. Essentially that startup script does iptables-restore </etc/sysconfig/iptables.
    – Ciclamino
    Jun 27, 2013 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .