How to save IPtables rules in Debian
Written by A.Jesin Saturday, 22 October 2011 02:15
This article explains how to make IPtables firewall rules sustain a boot in Debian. But this can also be applied on other Debian based OSes like Ubuntu and Knoppix. You show execute all these commands as the root user or use the sudo command to do it.
First view the list of rules in IPtables
iptables -L
If its a new installation there will be no rules. So add some firewall rules, the following rules will allow HTTP, HTTPS, FTP, SMTP, SSH incoming connections and rejects all other incoming connections including ICMP ping packets.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j REJECT
View the firewall rules once more
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:www
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Write these rules to a file using the following command.
iptables-save > /etc/iptables.rules
Now each time Debian boots iptables-restore command has to be called with these rules, so create and edit a new file as shown below. This file does NOT exist and you have to create it. I’m using VI editor to edit it
vi /etc/network/if-pre-up.d/firewall
Add the following text to that file
#!/bin/bash
/sbin/iptables-restore < /etc/iptables.rules
Save the file and grant executable permissions on that file.
chmod +x /etc/network/if-pre-up.d/firewall
Reboot the system and list the iptables rules to check if it has been applied.
reboot
After reboot
iptables -L
IMPORTANT: Whenever you add or delete rules you should overwrite the changes to the iptables.rules file using the following command
iptables-save > /etc/iptables.rules
Also read:
- Linux iptables LOG everything
- How to configure NIS server in Linux
- Configure Apache Web Server Load Balancing
- Setup Linux DNS Server for Windows Active Directory
