LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-09-2009, 08:28 AM   #1
qwertyjjj
Senior Member
 
Registered: Jul 2009
Location: UK
Distribution: Cent OS5 with Plesk
Posts: 1,012

Rep: Reputation: 30
if server restarts is iptables lost?


If the server restarts, does the information in iptables get lost?
I have seen a number of pages where people recommend readding lines or creating bash scripts to get it to work again.

What about files like squid.conf, ncsa_auth files, etc.?
 
Old 08-09-2009, 08:56 AM   #2
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
Anything that's a .conf file is a text file, usually configured by the human, and will remain unchanged during reboot.

Iptables however has it's running configuration stored in the kernel-space somewhere (in memory) so yes, it does get wiped during reboot, and needs to be restored after boot. Iptables includes a few tools to do this, one of which (important) is the command `iptables-restore`.

You would have typically one of two or three common means of setting up your iptables after a boot:

1) Have an iptables "script" file, which you would implement with the `iptables-restore` command. The "script" I refer to can be created using `iptables-save > somefile` to dump your running configuration to a file.
2) Have a (bash or other scripting language) firewall script, which reads its configuration file(s) and then sets up iptables.
3) OR, have a bash script (or other language) which actually runs a series of "iptables -A" commands directly, putting in place the chains & filters that you want.

Check the iptables man page -- it's very complete, but can be confusing -- or try HERE for what I have found to be a really handy breakdown of how to do lots of iptables stuff. Sections 8.3 and 8.4 talk about iptables-save/restore.

Sasha

Last edited by GrapefruiTgirl; 08-09-2009 at 08:59 AM.
 
Old 08-09-2009, 09:01 AM   #3
qwertyjjj
Senior Member
 
Registered: Jul 2009
Location: UK
Distribution: Cent OS5 with Plesk
Posts: 1,012

Original Poster
Rep: Reputation: 30
Will this work in CentOS?
/etc/init.d/iptables save

One document said to do this:
Quote:
Example

For example, save current iptables firewall rules:
# iptables-save > /root/dsl.fw
To restore iptables rules:
# iptables-restore < /root/dsl.fw
Redhat/Fedora core linux

To restore rules automatically upon Linux system reboot add following command to your /etc/rc.local (if you are using Fedora or Red Hat Linux):
# vi /etc/rc.local
Append the line:
iptables-restore < /root/dsl.fw

Last edited by qwertyjjj; 08-09-2009 at 09:03 AM.
 
Old 08-09-2009, 09:13 AM   #4
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
Assuming that the symlink /etc/init.d/iptables exists, then yes, it should work. However, note in the Example you quoted, you need to use a redirect > to direct the save into a file. This file is then used to restore the identical configuration later.

I can't speak directly about how a CentOS server/system is configured, but the iptables program(s) work the same, regardless of the Linux; it's just the locations of the binarie(s) and the individual init script locations that may differ.

Sasha
 
Old 08-09-2009, 10:05 AM   #5
qwertyjjj
Senior Member
 
Registered: Jul 2009
Location: UK
Distribution: Cent OS5 with Plesk
Posts: 1,012

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by GrapefruiTgirl View Post
Assuming that the symlink /etc/init.d/iptables exists, then yes, it should work. However, note in the Example you quoted, you need to use a redirect > to direct the save into a file. This file is then used to restore the identical configuration later.

I can't speak directly about how a CentOS server/system is configured, but the iptables program(s) work the same, regardless of the Linux; it's just the locations of the binarie(s) and the individual init script locations that may differ.

Sasha
Ok.

So, what the difference between running this:
/etc/init.d/iptables save

and this:
# iptables-save > /root/dsl.fw

To restore rules automatically upon Linux system reboot add following command to your /etc/rc.local (if you are using Fedora or Red Hat Linux):
# vi /etc/rc.local
Append the line:
iptables-restore < /root/dsl.fw

The first one just seems to be an auto command, yet the 2nd you have to save a file and then change a system file.
 
Old 08-09-2009, 10:11 AM   #6
qwertyjjj
Senior Member
 
Registered: Jul 2009
Location: UK
Distribution: Cent OS5 with Plesk
Posts: 1,012

Original Poster
Rep: Reputation: 30
so I did this:
iptables-save > /etc/firewall.conf

then edited the rc.local file to
Code:
[root@localhost ~]# vi /etc/rc.local
quotacheck -vagum
quotaon -av
/etc/init.d/ntpd stop
/usr/sbin/ntpdate 213.xxx.xxx.x
/etc/init.d/ntpd start

/etc/sysconfig/firewall
/sbin/modprobe ip_conntrack_ftp
/usr/sbin/update-alternatives --set mta /usr/sbin/sendmail.postfix

iptables-restore < /etc/firewall.conf
Will that work? DO I need to restart the rc.local file somehow or just save it?
 
Old 08-09-2009, 10:20 AM   #7
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
Quote:
Originally Posted by qwertyjjj View Post
Ok.

So, what the difference between running this:
/etc/init.d/iptables save

and this:
# iptables-save > /root/dsl.fw

To restore rules automatically upon Linux system reboot add following command to your /etc/rc.local (if you are using Fedora or Red Hat Linux):
# vi /etc/rc.local
Append the line:
iptables-restore < /root/dsl.fw

The first one just seems to be an auto command, yet the 2nd you have to save a file and then change a system file.
You'd need to look on your own system, and see exactly what is the file /etc/init.d/iptables. It's probably a symlink. And without specifying a file or location to save *to*, I have no clue *where* the saved data will go..

It's end result is otherwise exactly the same as the iptables-save > /root/dsl.fw except here, we see the data being saved to the file dsl.fw.

rc.local is a init script, executed as root during boot of the machine. In it, the user (you) can put stuff that is not default system configuration stuff, but which you would like to run at the end of the boot process. I use it to execute my firewall, run hdparm, modprobe a modem driver, and stuff like this. It is technically a 'system file' but it is there for your own custom config options.

There's a similar file you can use, called rc.local.shutdown where you can put stuff that you want executed automatically during shutdown too.

The line you put up there which is iptables-restore < /root/dsl.fw just causes the iptables configuration to be restored during boot.

Sasha
 
Old 08-09-2009, 10:25 AM   #8
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
Quote:
Originally Posted by qwertyjjj View Post
so I did this:
iptables-save > /etc/firewall.conf

then edited the rc.local file to
Code:
[root@localhost ~]# vi /etc/rc.local
quotacheck -vagum
quotaon -av
/etc/init.d/ntpd stop
/usr/sbin/ntpdate 213.xxx.xxx.x
/etc/init.d/ntpd start

/etc/sysconfig/firewall
/sbin/modprobe ip_conntrack_ftp
/usr/sbin/update-alternatives --set mta /usr/sbin/sendmail.postfix

iptables-restore < /etc/firewall.conf
Will that work? DO I need to restart the rc.local file somehow or just save it?
Yep, looks pretty correct to me. Just save the file. You don't need to execute it again, unless you want to execute the commands that are in it.

Otherwise, just save it, and it should be executed automatically upon reboot.

(TIP): I have a line in my init scripts, near the top, which tells me on the console during bootup, which init script is executing. Simple, like:

echo "Executing rc.local..."

at the top of the file. This way, you KNOW your rc.local file is being executed.

Sasha
 
Old 08-09-2009, 01:43 PM   #9
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
In Centos (RedHat for the poor) your /etc/init.d/iptables save will
put the config file into /etc/sysconfig/iptables.
If you've run
service iptables on
that is all you need to do. While there's nothing wrong with your
way of doing things it would make sense to stick with the methodology
of the distro you're using.



Cheers,
Tink
 
Old 08-09-2009, 03:03 PM   #10
qwertyjjj
Senior Member
 
Registered: Jul 2009
Location: UK
Distribution: Cent OS5 with Plesk
Posts: 1,012

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by Tinkster View Post
In Centos (RedHat for the poor) your /etc/init.d/iptables save will
put the config file into /etc/sysconfig/iptables.
If you've run
service iptables on
that is all you need to do. While there's nothing wrong with your
way of doing things it would make sense to stick with the methodology
of the distro you're using.



Cheers,
Tink
service iptables on or service iptables start?
I have run iptables restart a few times to flush after adding new rules so it that the same thing?
So, using this method there is no need to save the settings anywhere?
The same rules will be used even if the server is restarted?

do I need to resave every time I make a change?

Last edited by qwertyjjj; 08-09-2009 at 03:39 PM.
 
Old 08-09-2009, 03:51 PM   #11
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Quote:
Originally Posted by qwertyjjj View Post
service iptables on or service iptables start?
Ooops ... that was before my first coffee ;}
service iptables start
chkconfig iptables on

Quote:
Originally Posted by qwertyjjj View Post
I have run iptables restart a few times to flush after adding new rules so it that the same thing?
If you add new rules by manually invoking
iptables -A ....
you'd need to do an service iptables save to make them
take after a service restart

Quote:
Originally Posted by qwertyjjj View Post
So, using this method there is no need to save the settings anywhere?
The same rules will be used even if the server is restarted?
No, you still need to save, but not by invoking iptables-save > ...
but rather using the built-in functionality and the system-defined
save mechanism.

Quote:
Originally Posted by qwertyjjj View Post
do I need to resave every time I make a change?
See above.



Cheers,
Tink
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
X-server restarts when using glx Canadian_2k2 Linux - Desktop 1 04-05-2007 06:28 PM
Wine restarts X server avallach Linux - Software 5 03-07-2007 04:01 PM
X server not starting and continuously restarts manleonisme Linux - Software 1 05-17-2006 10:27 PM
Server restarts while scannink its ports rafal_ Slackware 31 08-15-2005 11:43 AM
X server restarts jayakrishnan Linux - General 1 11-13-2003 06:02 AM


All times are GMT -5. The time now is 05:01 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration