Fix Iptables Not Persisting After Reboot on CentOS 6.2

centosfirewalliptableslinux

I've tried adding a few rules to my iptables but they don't seem to be saving. In order to save them, I've tried running iptables-save and service iptables save. Each time I have run either of those commands, it says that it has saved successfully. Here are the rules I am trying to insert:

iptables -A INPUT -j REJECT -p tcp --destination-port 3306
iptables -A INPUT -j REJECT -p tcp --destination-port 25

These rules work and will stay in place after I input them, but when I go to reboot the system they are gone from the list when running iptables -L and the ports are open again (checked using nmap).

When looking at my /etc/sysconfig/iptables file, the rules are there (at the bottom) and all of the "completed" timestamps are from when I saved the rules which seems correct. Also, in my /etc/sysconfig/iptables-config file all of the settings are default and do not seem to change anything as far as loading iptable rules from a different location or something.

Best Answer

If the changes are not visible with iptables -L after a restart, it suggests that either:

  • The rules aren't being saved

    • You suggest that they are, but at the same time say 'completed timestamps' - plural. This might imply that you have more than one copy of the rules in the same file, and only the first set is being applied.
      • Redirect the output from iptables-save to the above file (don't append): 
        iptables-save > /etc/sysconfig/iptables
      • Alternatively, just move the existing file elsewhere, and then save.

  • The rules are being saved to the wrong file

    • Your configuration may be setup to load a different file than the one you are saving to - ensure that the file being loaded matches the file you save to.
      • The file is normally /etc/sysconfig/iptables
      • If you look in /etc/init.d/iptables, you should find the following lines which determine which file will be loaded: 
        IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES

  • There is an error with the rules

    • This is usually not an issue - iptables typically just ignores erroneous rules; and you are not writing them by hand (you are saving a presumably working ruleset).

  • iptables is not started on boot

    • run 
      chkconfig --list iptables
      to check in which runlevels iptables is loaded. If is is not enabled in the right runlevel, add it with 
      chkconfig --level 2345 iptables on

You should be able to test your setup by just restarting iptables (as opposed to restarting the machine):

service iptables restart

Standard iptables disclaimer: just in case something goes wrong...

  • back up your existing ruleset: 
    cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak
  • setup a cron job that will flush your iptables after a few minutes (of course, remove this once everything is working).
Related Topic