LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-13-2010, 01:48 PM   #1
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,685

Rep: Reputation: 48
iptables help, don't think my changes saved


I did the following commands:

iptables -A INPUT -p tcp -s 1.2.3.4 -d 10.9.8.7 --dport 21 -j ACCEPT
iptables-save
iptables -L
more iptables


I wanted to allow 1.2.3.4 to ftp to my server, then save that rule to iptables so when my server restarts its still there.

when i do iptables -L i see the rule listed, when I do more iptables I don't see it anywhere. Did i miss a step?
 
Old 01-13-2010, 01:54 PM   #2
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
When you do 'iptables-save' you must actually 'save' the output to your firewall script.

From the commands you did above, you did:

1) add the new rule
2) iptables-save to the screen (stdout)
3) iptables -L (which shows you the loaded iptables)
4) more iptables (this would show you a file called "iptables" if one exists in your current working directory)


I believe you should have (at step 2) dumped "iptables-save" into your firewall script, like:

shell# iptables-save > iptables

assuming your firewall script is named "iptables".

Sasha
 
Old 01-13-2010, 02:11 PM   #3
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,685

Original Poster
Rep: Reputation: 48
Looks like that worked. when i do the more iptables, I do see it in there now. but it added a -m tcp to the line for some reason.

also, do i have to restart iptables now for it to kick in?
 
Old 01-13-2010, 02:18 PM   #4
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
Once you add the line, the rule is implemented immediately. You don't need to restart iptables, as it's already 'kicked in'.

I'm not sure why the "-m tcp" appeared if you did not put it there, but maybe where you used "-p tcp" implies "-m tcp" automatically. Kinda makes sense-- if you want to match to TCP protocol (-p tcp), then -m is sort of implied. You'd need to check the man page or other docs to verify that this is precisely what's happening though.

Sasha
 
Old 01-13-2010, 02:20 PM   #5
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,685

Original Poster
Rep: Reputation: 48
I love when things just kick in! thanks for the help!!
 
Old 01-13-2010, 02:49 PM   #6
GrapefruiTgirl
LQ Guru
 
Registered: Dec 2006
Location: underground
Distribution: Slackware64
Posts: 7,594

Rep: Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551Reputation: 551
For the record, here's a chunk of the iptables man page:

Code:
MATCH EXTENSIONS
       iptables can use extended packet matching modules.  These are loaded in two ways: implicitly, when -p or  --protocol
       is  specified,  or  with the -m or --match options, followed by the matching module name; after these, various extra
       command line options become available, depending on the specific module.  You can specify  multiple  extended  match
       modules  in  one  line, and you can use the -h or --help options after the module has been specified to receive help
       specific to that module.
So the bold part does explain why the -m showed up: it was implied by -p

Cheers!
Sasha
 
Old 01-13-2010, 02:52 PM   #7
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,685

Original Poster
Rep: Reputation: 48
Excellent, thanks Sasha!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can't open saved web pages just saved by web browser... JeanBrownHarrel General 2 04-06-2008 11:52 AM
Saved Spider_Mastermind Linux - Newbie 1 03-12-2006 03:33 PM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 08:20 PM
Are iptables saved on reboot? drgowans Linux - Security 4 09-13-2003 02:51 PM


All times are GMT -5. The time now is 08:40 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration