Comments on: Standard Process for Restoring IPtables at Boot? http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/ Enhancing your Ubuntu experience! Fri, 11 May 2012 05:04:26 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Tig http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-8057 Tig Sun, 08 Mar 2009 12:20:20 +0000 http://ubuntu-tutorials.com/?p=961#comment-8057 Got to love Google and the Debian community. Thank you for helping me to decide which way is best for this very task. I use Firewall Builder to create my rules (God I love that program) and save the rules into defaults as per the way you advise. However, I'm with Adam on using a script in if-up.d to restore, it just makes more sense to me personally. Great advice from all, however. /Tig Got to love Google and the Debian community. Thank you for helping me to decide which way is best for this very task.

I use Firewall Builder to create my rules (God I love that program) and save the rules into defaults as per the way you advise. However, I’m with Adam on using a script in if-up.d to restore, it just makes more sense to me personally.

Great advice from all, however.

/Tig

]]> By: MTecknology http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-8003 MTecknology Wed, 04 Mar 2009 18:03:43 +0000 http://ubuntu-tutorials.com/?p=961#comment-8003 I do the rc.local as well. I do the rc.local as well.

]]> By: budiw http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7976 budiw Tue, 03 Mar 2009 09:06:23 +0000 http://ubuntu-tutorials.com/?p=961#comment-7976 I'm using /etc/rc.local. The script of iptables I save in some file, and then loaded in rc.local --budiw I’m using /etc/rc.local. The script of iptables I save in some file, and then loaded in rc.local

–budiw

]]> By: James Nachbar http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7964 James Nachbar Sun, 01 Mar 2009 21:45:20 +0000 http://ubuntu-tutorials.com/?p=961#comment-7964 With the new Upstart init system, I just create a new file, /etc/event.d/iptables : # Script to start firewall # Save rules with iptables-save > /etc/default/iptables start on runlevel 1 start on runlevel 2 start on runlevel 3 start on runlevel 4 start on runlevel 5 exec /sbin/iptables-restore < /etc/default/iptables That way, you aren't changing any existing files, just adding the new one. On every reboot, the iptables rules get loaded. You can check that they are loaded with: sudo /sbin/iptables-save | less With the new Upstart init system, I just create a new file, /etc/event.d/iptables :

# Script to start firewall
# Save rules with iptables-save > /etc/default/iptables

start on runlevel 1
start on runlevel 2
start on runlevel 3
start on runlevel 4
start on runlevel 5

exec /sbin/iptables-restore < /etc/default/iptables

That way, you aren’t changing any existing files, just adding the new one. On every reboot, the iptables rules get loaded. You can check that they are loaded with:

sudo /sbin/iptables-save | less

]]> By: zonky http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7963 zonky Sun, 01 Mar 2009 19:15:38 +0000 http://ubuntu-tutorials.com/?p=961#comment-7963 It's worth remembering with the proliferation of Xen based Virtual Hosting, that /etc/network/interfaces seems to be commonly replaced at bootup. You're probably safer to stick this in /etc/network/if-up.d It’s worth remembering with the proliferation of Xen based Virtual Hosting, that /etc/network/interfaces seems to be commonly replaced at bootup.

You’re probably safer to stick this in
/etc/network/if-up.d

]]> By: Tim. http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7961 Tim. Sun, 01 Mar 2009 15:45:13 +0000 http://ubuntu-tutorials.com/?p=961#comment-7961 I just use something like shorewall... way easier to maintain in the long run. I just use something like shorewall… way easier to maintain in the long run.

]]> By: agentk http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7955 agentk Sat, 28 Feb 2009 21:52:43 +0000 http://ubuntu-tutorials.com/?p=961#comment-7955 I actually liked the Redhat init script that much that I just copied to my Ubuntu install and made come changes from there. It just saves the tables to /etc/iptables/config now. I actually liked the Redhat init script that much that I just copied to my Ubuntu install and made come changes from there.
It just saves the tables to /etc/iptables/config now.

]]> By: Anthony http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7954 Anthony Sat, 28 Feb 2009 21:28:43 +0000 http://ubuntu-tutorials.com/?p=961#comment-7954 I'm using ufw on my boxes and it seems to take care of that on it's own, storing the rules in /var/lib/ufw/user.rules. However your solution seems fairly solid to me. I’m using ufw on my boxes and it seems to take care of that on it’s own, storing the rules in /var/lib/ufw/user.rules. However your solution seems fairly solid to me.

]]> By: Matt Mossholder http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7953 Matt Mossholder Sat, 28 Feb 2009 19:03:38 +0000 http://ubuntu-tutorials.com/?p=961#comment-7953 The only gotcha I can think of with doing it in /etc/network/interfaces is that you are tying the ruleset to a specific interface. If that interface doesn't come up for some reason, the iptables rules don't get loaded. It is too bad that iptables-save doesn't have options to save the rules by interface, such that we could save global rules, and load them when lo starts, and interface specific rules that could be loaded with each interface. As things stand, I would probably have the pre-up bound to lo, rather than eth0. The only gotcha I can think of with doing it in /etc/network/interfaces is that you are tying the ruleset to a specific interface. If that interface doesn’t come up for some reason, the iptables rules don’t get loaded.

It is too bad that iptables-save doesn’t have options to save the rules by interface, such that we could save global rules, and load them when lo starts, and interface specific rules that could be loaded with each interface.

As things stand, I would probably have the pre-up bound to lo, rather than eth0.

]]> By: Adam http://ubuntu-tutorials.com/2009/02/28/standard-process-for-restoring-iptables-at-boot/#comment-7952 Adam Sat, 28 Feb 2009 18:47:58 +0000 http://ubuntu-tutorials.com/?p=961#comment-7952 I use a short script in /etc/network/if-up.d which contains other scripts such as reloading OpenSSH so it can bind to the new address, running ntpdate, etc. $ cat /etc/network/if-up.d/iptables iptables-restore < /etc/iptables.up.rules I use a short script in /etc/network/if-up.d which contains other scripts such as reloading OpenSSH so it can bind to the new address, running ntpdate, etc.

$ cat /etc/network/if-up.d/iptables
iptables-restore < /etc/iptables.up.rules

]]>