top button
Flag Notify
    Connect to us
      Site Registration

Site Registration

IPTables not flushing on Fedora?

0 votes
583 views

I'm playing around with iptables and have inserted a few new rules. Now, I want to flush them all so I use

iptables -F

Then, I restart the firewall with

service iptables restart

and everything looks like it's restarting alright. But when I list the rules using

iptables -L

I get a list of rules THAT INCLUDE all of the rules I've defined before the flush! Am I reading this wrong or is something weird with my iptables?

posted Jun 3, 2013 by anonymous

Share this question
Facebook Share Button Twitter Share Button LinkedIn Share Button

1 Answer

+1 vote

First, I think it is best to confirm the version of Fedora you're running. Also, you're wanting to use the iptables service so, you've disabled firewalld and enabled iptables?

answer Jun 3, 2013 by anonymous
I'm running F18 and, no, I did not disable firewalld. I'm completely new to configurable firewalls and didn't even know firewalld was running. I assumed iptables was the default firewall in place.
commented Jun 3, 2013 by anonymous
Start here....
https://fedoraproject.org/wiki/FirewallD
commented Jun 3, 2013 by anonymous
You may also benefit from this....
http://fedoraproject.org/wiki/Systemd
commented Jun 3, 2013 by anonymous
If you are using iptables, then after an iptables rules flush/change, you need to do a 'service iptables save' to make the rules flush/change persistent*, before the iptables restart.

*/etc/sysconfig/iptables
commented Jun 4, 2013 by anonymous
Similar Questions
+1 vote
IPtables: if you reboot the machine configurations are not loaded?

I have a problem with iptables on CentOS 6.2.

I configured:

chkconfig iptables on
and the file /etc/sysconfig/iptables

If you reboot the machine configurations are not loaded. iptables-L gives me the default configurations (not assigned) if I (a machine booted): service iptables start then then it works. How can I fix?

+1 vote
Getting iptables not to reply

If you have an 'accept' rule for a service that is not currently running, is it possible to have iptables to simply not respond instead of reporting the port as 'closed'? During a port scan at grc.com, if the router doesn't reply the port will be reported as 'stealth'.

0 votes
Where is the iptables firewall configuration file on Fedora 19?

It's no longer in /etc/sysconfig/iptables.

0 votes
iptables with logging vs denyhosts

I have been using denyhosts for almost a year. To date I have only prevented one person logging in and that is ME ( I used the wrong login name).
Also, I know of no successful break-ins.

My iptables is as follows:

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-N block
-A INPUT -j block
-A FORWARD -j block
-A block -i wifi_card -p tcp -m tcp --dport 12123 -j ACCEPT
-A block -i Nic_external -p tcp -m tcp --dport 12123 -j ACCEPT
-A block -i Nic_enternal -j ACCEPT
-A block -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A block -i lo -m conntrack --ctstate NEW -j ACCEPT
-A block -j DROP

First, I think that the above will keep the bad guys out, Is that a true statement?

Sencondly, I have added a LOG rule just above the DROP rule and I have been monitoring it for about 1 1/2 weeks. As each entry is logged I have been adding it to /etc/hosts.deny. Currently there are 4318 ip adresses in the file and the number of packets that have been logged is 51592.

Denyhosts is for stopping ssh attempts and nothing else as I understand it.

Having over 4300 lines in /etc/hosts.deny causes almost no delay in logging in remotely.

Am I being to paranoid about keeping the bad guys out or is the iptable above completely adequate?

I would very much like to here your opinion on this,

+2 votes
how to replace the next iptables rule with nft?

Can someone help on how to replace the next iptables rule with nft:

iptables -t raw -A PREROUTING -i eth0 -j CT --notrack

Is this possible with nft or not?

...