Persistent iptables

Question

I've just read about iptables-persistent and I'm completely lost w.r.t. the design. I'm not the only one, who didn't understand how it works, but actually it seems to be way beyond my imagination.

I imagined something like crontab -e: You edit a set of rules and they get persisted and applied when the editor gets closed. They get stored somewhere and I as a user have no idea where. Don't tell me; it's perfect this way.

Is there such a tool? Why does iptables-persistent work in this hard to follow way?

Answer 1

In general, you can edit the active iptables rules for IPv4 with a text editor by using the iptables-save command to write the rules to a file and then using the iptables-restore command to reload the new rules after you're done, e.g.:

user@host:~$ iptables-save > rules.v4
user@host:~$ vim rules.v4
user@host:~$ iptables-restore rules.v4

For IPv6 you would use the analogous commands ip6tables-save and ip6tables-restore, i.e.:

user@host:~$ ip6tables-save > rules.v6
user@host:~$ vim rules.v6
user@host:~$ ip6tables-restore rules.v6

The iptables-persistent service checks in the following locations:

/etc/iptables/rules.v4
/etc/iptables/rules.v6

So to apply your rules and have them persist you would follow the same steps as above, but edit the iptables-persistent files instead, e.g.:

user@host:~$ iptables-save > /etc/iptables/rules.v4
user@host:~$ vim /etc/iptables/rules.v4
user@host:~$ iptables-restore /etc/iptables/rules.v4

I don't know of an interactive command for editing iptables rules like what you're describing, but it should be pretty easy to roll your own. Here is a simple example:

#!/usr/bin/env bash

# iptables-e.sh

# Create a temporary file to store the new rules
TEMPFILE=$(mktemp)

# Save the current rules to a file
iptables-save > "${TEMPFILE}"

# Edit the rules interactively with a text editor
"${EDITOR}" "${TEMPFILE}" 

# Try to load the rules and update the persistent rules if no errors occur
iptables-restore "${TEMPFILE}" && cat "${TEMPFILE}" > /etc/iptables/rules.v4

This actually isn't too much different from how crontab -e works, which just automatically saves the active crontab to a file in the /var/spool/cron/crontabs directory, which is what causes the crontab to be persistent. See the following post for further discussion of this subject:

• Where is the user crontab stored?

You might also be interested in the following script:

• iptables wizard

I can't vouch for it though. I've never used it. It's just the only thing I found by searching for interactive iptables editing.

Answer 2

Why don't you just make a script like this:

#!/bin/bash
...
${YOUR_IPTABLES_RULES}
...

And then just launch the script every time you reboot your machine:

# vim /etc/crontab
@reboot         root         /bin/bash /root/bin/myiptablesrules.sh

This way you would habe persistent rules, too :)

Answer 3

Have you tried using the iptables-save command?

iptables-save > /path/to/file
ip6tables-save > /path/to/file
iptables-restore < /path/to/file
ip6tables-restore < /path/to/file

You could just save to file manually and add the restore command to run at boot or login. The resulting files are easily human readable and contain the equivalent iptables commands for each entry. You could also edit the resulting files before reloading them. At least that's what I do. Not sure if this is the best method but it definitely works.