☰

Debian 重启后 iptables 没有恢复新规则

tag-icon • tag-icon debian iptables
Debian 重启后 iptables 没有恢复新规则

我尝试过很多类似的问题，如下所示，在我的例子中，我使用了 VMDebian操作系统在虚拟盒子:

  1. https://serverfault.com/questions/129086/how-to-start-stop-iptables-on-ubuntu
  2. 为什么重启 Debian 系统后 iptables 规则会消失？
  3. https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-rules
  4. https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-iptables-on-ubuntu-14-04

我尝试iptables用这些命令刷新规则：

sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

接下来是这些命令：

sudo iptables -t nat -F
sudo iptables -t mangle -F
sudo iptables -F
sudo iptables -X

我尝试过：

iptables-save > /etc/iptables/rules.v4
iptables-save > /etc/iptables/rules.v6

当我重新启动机器时，它再次回到旧规则......我仍然有相同的规则。我尝试使用iptables-save，并收到这些消息。

# Generated by iptables-save v1.4.21 on Wed Mar 28 03:44:14 2018
*nat
:PREROUTING ACCEPT [127:23299]
:INPUT ACCEPT [14:1996]
:OUTPUT ACCEPT [32:1947]
:POSTROUTING ACCEPT [32:1947]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_public - [0:0]
:POST_public_allow - [0:0]
:POST_public_deny - [0:0]
:POST_public_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING_ZONES -g POST_public
-A POST_public -j POST_public_log
-A POST_public -j POST_public_deny
-A POST_public -j POST_public_allow
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Wed Mar 28 03:44:14 2018
# Generated by iptables-save v1.4.21 on Wed Mar 28 03:44:14 2018
*mangle
:PREROUTING ACCEPT [4925:1051078]
:INPUT ACCEPT [4925:1051078]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4791:1080206]
:POSTROUTING ACCEPT [4791:1080206]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_public - [0:0]
:PRE_public_allow - [0:0]
:PRE_public_deny - [0:0]
:PRE_public_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -g PRE_public
-A PRE_public -j PRE_public_log
-A PRE_public -j PRE_public_deny
-A PRE_public -j PRE_public_allow
COMMIT
# Completed on Wed Mar 28 03:44:14 2018
# Generated by iptables-save v1.4.21 on Wed Mar 28 03:44:14 2018
*security
:INPUT ACCEPT [4826:1030935]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4814:1084121]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Wed Mar 28 03:44:14 2018
# Generated by iptables-save v1.4.21 on Wed Mar 28 03:44:14 2018
*raw
:PREROUTING ACCEPT [4949:1054264]
:OUTPUT ACCEPT [4815:1084545]
:OUTPUT_direct - [0:0]
:PREROUTING_direct - [0:0]
-A PREROUTING -j PREROUTING_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Wed Mar 28 03:44:14 2018
# Generated by iptables-save v1.4.21 on Wed Mar 28 03:44:14 2018
*filter
:INPUT ACCEPT [2653:591941]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2649:609004]
COMMIT
# Completed on Wed Mar 28 03:44:14 2018

我想要的是像下面的规则。我已将我的rules.v4命令设置为：

# Generated by iptables-save v1.4.21 on Tue Mar 27 02:48:59 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Tue Mar 27 02:48:59 2018

但每当我重新启动系统时，我总是得到以前的规则......

我的配置可能出现什么问题？我是不是错过了什么？

我尝试卸载iptables-persistent并重新安装它，但我仍然得到相同的规则......

答案1

使用以下命令保存 IPV6 表：

ip6tables-save > /etc/iptables/rules.v6

要恢复 IPV6 表，请使用：

ip6tables-restore < /etc/iptables/rules.v6

该命令iptables-save仅iptables-restore用于管理IPV4 表。

看man iptables-save：

  iptables-save — dump iptables rules to stdout
  ip6tables-save — dump iptables rules to stdout

和man iptables-restore

 iptables-restore — Restore IP Tables
 ip6tables-restore — Restore IPv6 Tables

相关内容