Why do iptables rules disappear when restarting my Debian system?

Question

I add this rule:

sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \
       --dport 1723 -j DNAT --to-destination a.b.c.d:10000

When restart computer rules are deleted. Why?
What I can do to make the rules persist?

score 90 · Answer 1 · edited Mar 16 '22 at 07:22

90

On Debian, install iptables-persistent:

sudo apt-get install iptables-persistent

The package will automatically load /etc/iptables/rules for you during boot.

Any time you modify your rules, run /sbin/iptables-save > /etc/iptables/rules to save them. You can also add that to the shutdown sequence if you like.

edited Mar 16 '22 at 07:22

stackprotector

400
2
3
17

answered Oct 22 '12 at 01:51

bahamat

38,658
4
70
103

21

There are two different rule files: `/etc/iptables/rules.v4` and `/etc/iptables/rules.v6` for IPv4 and IPv6 respectively. If you want a table to apply to both kinds of connections you have to save it to both rule files. – PetaspeedBeaver Jan 23 '14 at 15:51
17

**Don't add it to your shutdown sequence!** If you botch your rules during changes/setup at least a good old reboot will get things back to the previously working state. – VertigoRay Feb 27 '17 at 23:03
1

If you want to save both kinds of rules (IPv4 & IPv6, as described by @PetaspeedBeaver) you need to use the `ip6tables` and `ip6tables-save` command. So, it's `iptables-save > /etc/iptables/rules.v4` for IPv4 iptables rules and `ip6tables-save > /etc/iptables/rules.v6` for IPv6 iptables rules. – miu Aug 30 '23 at 14:13

score 72 · Accepted Answer · answered Oct 19 '12 at 22:01

72

There is no option in iptables which will make your rules permanent. But you can use iptables-save and iptables-restore to fulfill your task.

First add the iptable rule using the command you gave.

Then save iptables rules to some file like /etc/iptables.conf using following command:

$  iptables-save > /etc/iptables.conf

Add the following command in /etc/rc.local to reload the rules in every reboot.

$  iptables-restore < /etc/iptables.conf

answered Oct 19 '12 at 22:01

pradeepchhetri

9,859
12
51
59

21

On Debian there is the `iptables-persistent` package which will do this. – bahamat Oct 20 '12 at 00:09
11

It's rather bad idea to place it in `rc.local` since there would be an open window gap between services start and firewall policy apply. I do prefer using `pre-up` *hook for loopback interface* in `/etc/network/interfaces` to overcome this. – poige Oct 20 '12 at 11:07
@poige: I agree 100%, `rc.local` might have the intended effect, but it's a kludge in this situation. – J. M. Becker Oct 20 '12 at 14:52
3

@bahamat: Installing that package is the best solution, It deserves it's own answer. – J. M. Becker Oct 20 '12 at 14:54
1

@TechZilla: Done. – bahamat Oct 22 '12 at 01:52
1

did not work for me on Raspbian Jessie ... – Flash Thunder Jan 29 '17 at 14:12

score 4 · Answer 3 · answered Mar 24 '19 at 17:22

After installing iptables-persistent above you can also save rules with the following shorter command on Ubuntu 16.04+: sudo netfilter-persistent save

And they can also be restored back to how they were last time you saved them with: sudo netfilter-persistent reload

score 2 · Answer 4 · answered May 27 '20 at 23:35

2

Because you did not save the iptables rules.

You can do that by using sudo iptables-save

answered May 27 '20 at 23:35

Sir Muffington

739
2
7
21

2

That command only shows the rules on the console. – PhoneixS Sep 29 '20 at 16:34

score 2 · Answer 5 · answered Nov 21 '21 at 03:11

Install iptables-persistent package
Whenever you change the rules of iptables, you should save the backup into following file using following command:

iptables-save -f /etc/iptables/rules.v4 (for iptables)

iptables-save -f /etc/iptables/rules.v6 (for ip6tables)

score -3 · Answer 6 · edited Mar 13 '21 at 20:01

-3

First install the persist iptables (ubunut or debian)

   apt install iptables-persistent

Run your statement:

   iptables -A INPUT -s 0/0 -p tcp --dport 5433 -j ACCEPT

Then save the settings

   iptables-save

Finally restart the machine to verify

reboot

edited Mar 13 '21 at 20:01

FargolK

1,629
1
12
20

answered Mar 13 '21 at 15:29

Henry Coarite

1
1

1

Did not work for me – trzczy Apr 02 '21 at 11:35
duplicate answer of https://unix.stackexchange.com/a/52522/72456 – αғsнιη Aug 17 '21 at 14:17
`iptables-save` does not save anything. Read the manual: `man iptables-save`. – stackprotector Mar 11 '22 at 15:39

Why do iptables rules disappear when restarting my Debian system?

6 Answers6

Linked

Related