Automatically restore firewall filter rules
Reloaded
![© Lead Image © stylephotographs, 123RF.com © Lead Image © stylephotographs, 123RF.com](/var/linux_magazin/storage/images/issues/2016/188/persistent-iptables/po-26240-123rf-robotic_arms_with_packages_resized.png/672232-1-eng-US/PO-26240-123RF-Robotic_arms_with_packages_resized.png_medium.png)
© Lead Image © stylephotographs, 123RF.com
The Linux iptables packet filter lacks an easy way to load rules automatically after restarting a system, but you can automate this process several ways.
Every administrator has to determine how to protect a network reliably against unauthorized access and ensure that the (sub)network fulfills its task as expected and is not misused as a starting point for malicious activities. At the network level, you have various ways and means at your disposal, including, for example, managing credentials for authenticating users (e.g., via PAM and LDAP), the appropriate selection of correctly configured services, and correct network device configurations.
Routers and firewalls are often used to isolate individual network segments, and the Linux kernel manages the firewall rules in the system's RAM. I demonstrate different methods for permanently storing your firewall settings by using iptables, thus removing the need to enter them again whenever you reboot.
Firewall Protection
From a network perspective, a firewall's primary objective is selecting and limiting the network packets that reach a network via a monitored interface on another network. In practice, firewalls are deployed not only as software directly on the system to be protected, but also in the form of separate hardware appliances that often combine various services under one roof.
In short, a firewall is a packet filter. Filtering is performed, for example, on the basis of (1) the IP address, (2) the connection state, (3) the MAC address, or (4) the payload of a packet.
The iptables
package by the Netfilter project [1] includes the iptables
command, which covers cases 1 and 2; for case 3, ebtables
[2] steps in. In the future, nftables
will combine the iptables, ip6tables, ebtables, and arptables projects under one roof. For case 4, evaluating and limiting user traffic, you need an application-level firewall, such as the Squid [3] proxy. In this article, I only look at iptables.
Operations
The iptables
command works in chains with rules (filters) and actions (targets). On the basis of these criteria, the software fields packages (ACCEPT
) and discards (DROP
or REJECT
) or forwards and rewrites them (MASQUERADE
).
Listing 1 shows a typical call sequence. In this example, only connections via port 22 with a source IP address between 192.168.45.0 and 192.168.45.255 are allowed to pass. The entry in line 1 clears all the existing rules; the commands in lines 2 to 4 set the default behavior.
Listing 1
Typical iptables
Line 5 adds a filtering rule to the chain for received packets. This limits the accepted packages (-j ACCEPT
) to TCP packets (-p tcp
) for the target port 22 (--dport 22
) from the subnet 192.168.45.x (-s 192.168.45.0/24
). Line 6 allows also the corresponding response packets (-j ACCEPT
) – original from port 22 here (--sport 22
) to the target network 192.168.45.x (-d 192.168.45.0/24
) and only for existing connections (--state ESTABLISHED
).
To apply these commands to IPv6, you need to use the new ip6tables
, which uses the same syntax.
Validity
As mentioned previously, the iptables rules apply only as long as the system is running. The software does not store the rules persistently; it only keeps them in main memory. If you turn off the computer or reboot it, the current firewall settings will be lost. To prevent having to enter them every time you reboot, you need to store the rules permanently and enable them automatically when the computer starts up.
The variants discussed here are based on my own experience and the firewall entries from the Debian wiki [4]. The intent was to use only built-in tools. The variations also show a selection of solutions – you can decide which best fit your purposes.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.