Score:0

Problem with my iptables configuration on reboot

io flag

I tried many times to save the iptables configuration to have it start up automatically when I reboot my Raspberry Pi (Ubuntu 22.04.1 LTS) but when I look with this command:

$ sudo iptables -L

my chain rules are gone after a reboot.

I followed this documentation:

https://help.ubuntu.com/community/IptablesHowTo

Here's the rules with the commands I used in that specific order:

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -j DROP
sudo iptables -I INPUT 1 -i lo -j ACCEPT

Then from the same documentation, they recommend Solution #1 or Solution #2 to save and restore iptables on reboot. I tried both without success.

Here's what I have done for the Solution #2:

I saved my firewall rules to the file iptables.rules like this:

sudo sh -c "iptables-save > /etc/iptables.rules"

I created this new file for a script at /etc/network/if-pre-up.d/iptablesload. Here's the content of the script which I edited with Vim:

#!/bin/sh
iptables-restore < /etc/iptables.rules
exit 0

I saved the file on Vim with :wq

Then I created this new file for a script at /etc/network/if-post-down.d/iptablessave. It contains:

#!/bin/sh
iptables-save -c > /etc/iptables.rules
if [ -f /etc/iptables.downrules ]; then
   iptables-restore < /etc/iptables.downrules
fi
exit 0

I saved the file on Vim with :wq

And finally I gave both scripts execute permissions like this:

sudo chmod +x /etc/network/if-post-down.d/iptablessave
sudo chmod +x /etc/network/if-pre-up.d/iptablesload

After doing all that, when I reboot my Raspberry Pi and type the command

sudo iptables -L 

all my chain rules are gone.

I am a beginner with Ubuntu, thank you for your help.

Doug Smythies avatar
gn flag
The issue is that your reference is not up to date. up-down is not used anymore, nor is `/etc/network/interfaces`. The networkmanager method might work for you, I don't know because I am a server person and don't use network manager. I use a script for my iptables rule set and run it upon boot via a service. Many users like iptables-perisistent.
dummyuser avatar
uy flag
try `apt install iptables-persistent` and `iptables-save -c > /etc/iptables/rules.v4`
Chookitypok avatar
io flag
@dummyuser it works after installing iptables-persistent but when I entered the command: `iptables-save -c > /etc/iptables/rules.v4` it's written `-bash: /etc/iptables/rules.v4: Permission denied`. I tried with `sudo` but it didn't work so I had to use `sudo su` to go on the root mode and then I can type the command.
dummyuser avatar
uy flag
perfect. so you got a nice answer.
Score:0
uy flag

Ubuntu provides the following method for loading iptables rules at boot time:

Software needed:

iptables-persistent must be installed

Rules at boot time:

the rules to be loaded at boot time are stored in /etc/iptables/rules.v4 (IPv4) and /etc/iptables/rules.v6 (IPv6). An existing v4 ruleset may be saved to /etc/iptables/rules.v4 with the command

iptables-save -c > /etc/iptables/rules.v4

or

ip6tables-save -c > /etc/iptables/rules.v6

There are other ways, like own scripts, started at boot time which are not described in detail within this question. Bad iptable rulesets may prevent your access to your server be carefull, always ask what happens if ... ?

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.