run iptable changes without rebooting
I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.
to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:
iptables-save >/etc/iptables/rules.v4
ip6tables-save >/etc/iptables/rules.v6
but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:
netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?
the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.
but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.
I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either
hope someone can give some inside)
thanks
NooBie
edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)
part of the script that does the firewall rules:
}
configure_firewall(){
msg "Configuring firewall..."
case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."
systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null
submsg1 "Setting ports/permissions..."
ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."
systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null
systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null
submsg1 "Setting ports/permissions..."
default_zone="$(firewall-cmd --get-default-zone)"
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null
firewall-cmd --reload &>/dev/null
;;
esac
if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi
if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi
}
server iptables
New contributor
|
show 3 more comments
I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.
to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:
iptables-save >/etc/iptables/rules.v4
ip6tables-save >/etc/iptables/rules.v6
but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:
netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?
the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.
but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.
I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either
hope someone can give some inside)
thanks
NooBie
edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)
part of the script that does the firewall rules:
}
configure_firewall(){
msg "Configuring firewall..."
case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."
systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null
submsg1 "Setting ports/permissions..."
ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."
systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null
systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null
submsg1 "Setting ports/permissions..."
default_zone="$(firewall-cmd --get-default-zone)"
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null
firewall-cmd --reload &>/dev/null
;;
esac
if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi
if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi
}
server iptables
New contributor
1
iptables-restore > /etc/iptables/rules.v4
doesn't make sense. This writes output fromiptables-restore
to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
– vidarlo
Dec 31 '18 at 12:23
i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43
You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45
yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48
Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, runsudo iptables -vF
and then re-apply the rules you want.
– Minty
Dec 31 '18 at 13:00
|
show 3 more comments
I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.
to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:
iptables-save >/etc/iptables/rules.v4
ip6tables-save >/etc/iptables/rules.v6
but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:
netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?
the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.
but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.
I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either
hope someone can give some inside)
thanks
NooBie
edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)
part of the script that does the firewall rules:
}
configure_firewall(){
msg "Configuring firewall..."
case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."
systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null
submsg1 "Setting ports/permissions..."
ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."
systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null
systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null
submsg1 "Setting ports/permissions..."
default_zone="$(firewall-cmd --get-default-zone)"
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null
firewall-cmd --reload &>/dev/null
;;
esac
if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi
if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi
}
server iptables
New contributor
I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.
to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:
iptables-save >/etc/iptables/rules.v4
ip6tables-save >/etc/iptables/rules.v6
but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:
netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?
the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.
but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.
I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either
hope someone can give some inside)
thanks
NooBie
edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)
part of the script that does the firewall rules:
}
configure_firewall(){
msg "Configuring firewall..."
case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."
systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null
submsg1 "Setting ports/permissions..."
ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."
systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null
systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null
submsg1 "Setting ports/permissions..."
default_zone="$(firewall-cmd --get-default-zone)"
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null
firewall-cmd --reload &>/dev/null
;;
esac
if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi
if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi
}
server iptables
server iptables
New contributor
New contributor
edited Dec 31 '18 at 12:45
New contributor
asked Dec 31 '18 at 12:20
Purely Crypto
11
11
New contributor
New contributor
1
iptables-restore > /etc/iptables/rules.v4
doesn't make sense. This writes output fromiptables-restore
to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
– vidarlo
Dec 31 '18 at 12:23
i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43
You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45
yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48
Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, runsudo iptables -vF
and then re-apply the rules you want.
– Minty
Dec 31 '18 at 13:00
|
show 3 more comments
1
iptables-restore > /etc/iptables/rules.v4
doesn't make sense. This writes output fromiptables-restore
to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
– vidarlo
Dec 31 '18 at 12:23
i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43
You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45
yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48
Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, runsudo iptables -vF
and then re-apply the rules you want.
– Minty
Dec 31 '18 at 13:00
1
1
iptables-restore > /etc/iptables/rules.v4
doesn't make sense. This writes output from iptables-restore
to the file. Please edit your post to include firewall rules you have, and exact commands you are running.– vidarlo
Dec 31 '18 at 12:23
iptables-restore > /etc/iptables/rules.v4
doesn't make sense. This writes output from iptables-restore
to the file. Please edit your post to include firewall rules you have, and exact commands you are running.– vidarlo
Dec 31 '18 at 12:23
i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43
i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43
You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45
You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45
yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48
yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48
Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run
sudo iptables -vF
and then re-apply the rules you want.– Minty
Dec 31 '18 at 13:00
Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run
sudo iptables -vF
and then re-apply the rules you want.– Minty
Dec 31 '18 at 13:00
|
show 3 more comments
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1105816%2frun-iptable-changes-without-rebooting%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.
Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.
Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.
Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1105816%2frun-iptable-changes-without-rebooting%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
iptables-restore > /etc/iptables/rules.v4
doesn't make sense. This writes output fromiptables-restore
to the file. Please edit your post to include firewall rules you have, and exact commands you are running.– vidarlo
Dec 31 '18 at 12:23
i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43
You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45
yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48
Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run
sudo iptables -vF
and then re-apply the rules you want.– Minty
Dec 31 '18 at 13:00