36

I'm trying to redirect http traffic to port 8080 on the same machine and have the iptables rules below working.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 8080

I'm trying to figure out how to make this change permanent incase of a reboot of the system.

I'm using Ubuntu 11.10 server.

1

4 Answers 4

136

Ubuntu (and Debian) offer the package iptables-persistent (Debian: http://packages.debian.org/wheezy/iptables-persistent , Ubuntu: http://packages.ubuntu.com/saucy/iptables-persistent) , which does exactly what you want. As root, or via sudo:

apt-get install iptables-persistent
iptables-save > /etc/iptables/rules.v4

If you're working with ip6tables, you'll want to also ip6tables-save > /etc/iptables/rules.v6.

You must save the tables again (iptables-save > /etc/iptables/rules.v4, ip6tables-save > /etc/iptables/rules.v6) after any change you make.

On older versions (before iptables-0.5, and before Debian Wheezy) you will need write to a different file:

iptables-save > /etc/iptables/rules
9
  • 12
    In case it helps anyone else... it took me a while to track down that I really needed to do this: iptables-save > /etc/iptables/rules.v4
    – mdahlman
    Jul 1, 2013 at 4:58
  • 9
    If you're using IPv6 too, it can be a pain to make sure the rules get to the right place. You can run the following to make that happen, automagically: invoke-rc.d iptables-persistent save Aug 25, 2013 at 16:44
  • 1
    @mdahlman depends on the Debian/Ubuntu version. I believe Debian <7 requires > /etc/iptables/rules and 7+ requires > /etc/iptables/rules.v4 Nov 25, 2013 at 12:35
  • 1
    @WilfredHughes ahh... that is very interesting. yomimomo, if you update your answer with an authoritative explanation of which versions of Ubuntu need which variation of the command you would be a hero.
    – mdahlman
    Nov 27, 2013 at 6:18
  • 6
    dpkg-reconfigure iptables-persistent if you want to rerun and save, not ideal but quick and dirty.
    – depicus
    May 27, 2014 at 21:04
19

One way to do this would be:

vim /etc/network/interfaces

Append the below line along with your lo directives:

post-up /sbin/iptables-restore < /etc/iptables-up.rules

Now run the below command

iptables-save > /etc/iptables-up.rules

I hope this helps.

5
  • 10
    Whoever finds this should consider the much better answer about iptables-persistent by yomimono below.
    – zakx
    May 27, 2014 at 13:21
  • 1
    Never use it this way, that leaves a window open at least for a moment wrong connection can be considered ESTABLISHED. Interface should be lo (loopback) instead of eth0 and pre-up instead of post-up.
    – poige
    Sep 6, 2014 at 10:56
  • I get a permission denied when trying to write to /etc, even in root mode
    – puk
    Jul 17, 2015 at 8:00
  • Agree with Zakx and Poige, this is one approach out of many but nothing wrong in it. @Poige I had issues with pre-up if there are any errors in iptables-up.rules file hence suggested post-up. Feb 3, 2018 at 14:23
  • pre-up …something_that_can_fail… || :
    – poige
    Feb 3, 2018 at 18:12
6

Can't we do the same thing with rc.local but perform the following steps

iptables-save > current_iptables_rules

Then go into /etc/rc.local and enter the following

iptables-restore < current_iptables_rules

Won't that accomplish the same thing? I could be missing something.

1
  • Yes this should work as well. Feb 3, 2018 at 14:24
2

Add them to /etc/ufw/before.rules. The syntax is a little different but you'll see how it works.

UFW is the Ubuntu firewall frontend to iptables. You might need to enable UFW using sudo ufw enable, but you can just not set any rules inside ufw.

Not the answer you're looking for? Browse other questions tagged or ask your own question.