[SOLVED] Iptables won't save for next boot

EDDY1 · 06-11-2014, 11:38 PM

During attempts to make my machine a dhcp server I realized that my default iptables were very insecure & have been trying to setup some rules for my iptables.
Upon completion I use the command

Code:

iptales-save -c

but upon reboot they go back to the default.
My system is DebianWheezy
Any help would be appreciated.

rhoekstra · 06-12-2014, 02:26 AM

Would this page help? http://www.thomas-krenn.com/en/wiki/...es_Permanently

EDDY1 · 06-12-2014, 03:17 AM

I have looked at that page but thought that since iptables have long been implimented that I should've been able to save without add the iptables-persistant package.
Also I was trying to do it manually.
I Also know there are some GUI programs for firewall but I'd like to know how to configure manually.
If all else fails I will add iptables-persistant package, just for security purposes.

rhoekstra · 06-12-2014, 03:37 AM

Iptables afaik has never had the possibility to store its rules persistently. It has always been a process of exporting current rules in a file to be imported at bootup.

iptables-save has always been the means to do so, wrapped in a script to be executed to save the rules.

---------- Post added 12-06-14 at 09:37 ----------

The page describes where to export the rules to, to be loaded at bootup I assume (not a Debian user, sorry)

EDDY1 · 06-12-2014, 03:42 AM

I'm new to iptables but you would think that if there is a default file that it would be edited directly, unless there are instances where you only want allow something to pass thru only once.
Also the default upon reboot must be stored somewhere because it comes back even thoug you supposedly flushed it.

rhoekstra · 06-12-2014, 03:58 AM

With Iptables, being 'in-kernel' only, it needs to be initialized at each bootup. therefore, iptables-save provides the current ruleset to be stored in a file which can be read at boot again. the format is not really for manual editing, but it can be done.

the /etc/iptables/rules is that specific location where iptables-save output gets stored.

EDDY1 · 06-12-2014, 05:05 AM

Quote:

the /etc/iptables/rules is that specific location where iptables-save output gets stored.

Yes I wss reading that part just recently & the file needs to be created as stated in debian wiki.https://wiki.debian.org/iptables

EDDY1 · 06-14-2014, 02:36 PM

Well I ended up installing iptables-persistant & have now saved a basic set up i[tables rules from this article.
http://wiki.centos.org/HowTos/Network/IPTables
And also saved using this 1
http://www.thomas-krenn.com/en/wiki/...es_Permanently

This the output of iptables -L -v

Quote:

Chain INPUT (policy DROP 79 packets, 16099 bytes)
pkts bytes target prot opt in out source destination
4 200 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 51 packets, 5514 bytes)
pkts bytes target prot opt in out source destination

Is there something that I should expand on?

rhoekstra · 06-17-2014, 06:30 AM

Not really sure what you're pointing at...

It seems you have quite a simplistic, but functional, firewall setting like that. If the 'iptables-persistant' package makes it restore the settings after a reboot (eg, just reboot, does 'iptables -Lv' show the same settings?), you're set. no need to 'expand' anything imo.

EDDY1 · 06-17-2014, 03:44 PM

Thank you for your response.

tairoylance112 · 06-18-2014, 07:29 AM

Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT 0 -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT 0 -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

EDDY1 · 06-18-2014, 12:03 PM

Quote:

Originally Posted by tairoylance112

Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT 0 -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT 0 -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Is this a more secure firewall?
Would it still allow me to ssh to my machine?

rhoekstra · 06-18-2014, 12:44 PM

No, items a rubbish post, no comments, no relevance at all. The shown data is incomplete even. Just remain at what you have

EDDY1 · 06-18-2014, 10:38 PM

Quote:

Originally Posted by rhoekstra

No, items a rubbish post, no comments, no relevance at all. The shown data is incomplete even. Just remain at what you have

Thank you for your input especially since you told me my basics would suffice.
I will have to go back to man iptables ti uderstand what they were referring to.