run iptable changes without rebooting












0














I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.



to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:



iptables-save >/etc/iptables/rules.v4



ip6tables-save >/etc/iptables/rules.v6



but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:



netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?



the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.



but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.



I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either



hope someone can give some inside)



thanks
NooBie



edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)



part of the script that does the firewall rules:



}


configure_firewall(){
msg "Configuring firewall..."



case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."

systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null

submsg1 "Setting ports/permissions..."

ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."

systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null

systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null

submsg1 "Setting ports/permissions..."

default_zone="$(firewall-cmd --get-default-zone)"

firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null

firewall-cmd --reload &>/dev/null
;;
esac

if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi

if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi


}










share|improve this question









New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
















  • 1




    iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
    – vidarlo
    Dec 31 '18 at 12:23










  • i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
    – Purely Crypto
    Dec 31 '18 at 12:43










  • You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
    – vidarlo
    Dec 31 '18 at 12:45










  • yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
    – Purely Crypto
    Dec 31 '18 at 12:48












  • Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want.
    – Minty
    Dec 31 '18 at 13:00


















0














I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.



to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:



iptables-save >/etc/iptables/rules.v4



ip6tables-save >/etc/iptables/rules.v6



but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:



netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?



the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.



but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.



I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either



hope someone can give some inside)



thanks
NooBie



edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)



part of the script that does the firewall rules:



}


configure_firewall(){
msg "Configuring firewall..."



case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."

systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null

submsg1 "Setting ports/permissions..."

ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."

systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null

systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null

submsg1 "Setting ports/permissions..."

default_zone="$(firewall-cmd --get-default-zone)"

firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null

firewall-cmd --reload &>/dev/null
;;
esac

if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi

if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi


}










share|improve this question









New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
















  • 1




    iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
    – vidarlo
    Dec 31 '18 at 12:23










  • i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
    – Purely Crypto
    Dec 31 '18 at 12:43










  • You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
    – vidarlo
    Dec 31 '18 at 12:45










  • yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
    – Purely Crypto
    Dec 31 '18 at 12:48












  • Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want.
    – Minty
    Dec 31 '18 at 13:00
















0












0








0







I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.



to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:



iptables-save >/etc/iptables/rules.v4



ip6tables-save >/etc/iptables/rules.v6



but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:



netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?



the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.



but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.



I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either



hope someone can give some inside)



thanks
NooBie



edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)



part of the script that does the firewall rules:



}


configure_firewall(){
msg "Configuring firewall..."



case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."

systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null

submsg1 "Setting ports/permissions..."

ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."

systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null

systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null

submsg1 "Setting ports/permissions..."

default_zone="$(firewall-cmd --get-default-zone)"

firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null

firewall-cmd --reload &>/dev/null
;;
esac

if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi

if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi


}










share|improve this question









New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed.
now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.



to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:



iptables-save >/etc/iptables/rules.v4



ip6tables-save >/etc/iptables/rules.v6



but when the script is done it doesnt open the ports, but from understanding every change you make is instant?
after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:



netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?



the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.



but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.



I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either



hope someone can give some inside)



thanks
NooBie



edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)



part of the script that does the firewall rules:



}


configure_firewall(){
msg "Configuring firewall..."



case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
submsg1 "Starting firewall..."

systemctl daemon-reload &>/dev/null
systemctl enable ufw &>/dev/null
systemctl start ufw &>/dev/null

submsg1 "Setting ports/permissions..."

ufw default allow outgoing &>/dev/null
ufw default deny incoming &>/dev/null
ufw allow ssh &>/dev/null
ufw limit ssh &>/dev/null
ufw allow 8895 &>/dev/null
ufw allow 30666 &>/dev/null
ufw logging on &>/dev/null
ufw --force enable &>/dev/null
;;
"centos7")
submsg1 "Starting firewall..."

systemctl disable ufw &>/dev/null
systemctl stop ufw &>/dev/null

systemctl daemon-reload &>/dev/null
systemctl enable firewalld &>/dev/null
systemctl start firewalld &>/dev/null

submsg1 "Setting ports/permissions..."

default_zone="$(firewall-cmd --get-default-zone)"

firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null

firewall-cmd --reload &>/dev/null
;;
esac

if hash iptables-save 2>/dev/null; then
# save iptables firewall rules
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
fi

if hash netfilter-persistent 2>/dev/null; then
netfilter-persistent start
fi


}







server iptables






share|improve this question









New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











share|improve this question









New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this question




share|improve this question








edited Dec 31 '18 at 12:45





















New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









asked Dec 31 '18 at 12:20









Purely Crypto

11




11




New contributor




Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Purely Crypto is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.








  • 1




    iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
    – vidarlo
    Dec 31 '18 at 12:23










  • i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
    – Purely Crypto
    Dec 31 '18 at 12:43










  • You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
    – vidarlo
    Dec 31 '18 at 12:45










  • yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
    – Purely Crypto
    Dec 31 '18 at 12:48












  • Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want.
    – Minty
    Dec 31 '18 at 13:00
















  • 1




    iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
    – vidarlo
    Dec 31 '18 at 12:23










  • i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
    – Purely Crypto
    Dec 31 '18 at 12:43










  • You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
    – vidarlo
    Dec 31 '18 at 12:45










  • yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
    – Purely Crypto
    Dec 31 '18 at 12:48












  • Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want.
    – Minty
    Dec 31 '18 at 13:00










1




1




iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
– vidarlo
Dec 31 '18 at 12:23




iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running.
– vidarlo
Dec 31 '18 at 12:23












i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43




i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong
– Purely Crypto
Dec 31 '18 at 12:43












You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45




You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work.
– vidarlo
Dec 31 '18 at 12:45












yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48






yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this
– Purely Crypto
Dec 31 '18 at 12:48














Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want.
– Minty
Dec 31 '18 at 13:00






Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want.
– Minty
Dec 31 '18 at 13:00












0






active

oldest

votes











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});






Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.










draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1105816%2frun-iptable-changes-without-rebooting%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes








Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.










draft saved

draft discarded


















Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.













Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.












Purely Crypto is a new contributor. Be nice, and check out our Code of Conduct.
















Thanks for contributing an answer to Ask Ubuntu!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1105816%2frun-iptable-changes-without-rebooting%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Human spaceflight

Can not write log (Is /dev/pts mounted?) - openpty in Ubuntu-on-Windows?

張江高科駅