Learn how to disable the iptables firewall in Linux temporarily for troubleshooting purposes. Also, learn how to save policies and how to restore them back when you enable the firewall back.
Sometimes you have the requirement to turn off the iptables firewall to do some connectivity troubleshooting and then you need to turn it back on. While doing it you also want to save all your firewall policies as well. In this article, we will walk you through how to save firewall policies and how to disable/enable an iptables firewall. For more details about the iptables firewall and policies read our article on it.
Save iptables policies
The first step while disabling the iptables firewall temporarily is to save existing firewall rules/policies.
iptables-save command lists all your existing policies which you can save in a file on your server.
root@kerneltalks # iptables-save # Generated by iptables-save v1.4.21 on Tue Jun 19 09:54:36 2018 *nat :PREROUTING ACCEPT [1:52] :INPUT ACCEPT [1:52] :OUTPUT ACCEPT [15:1140] :POSTROUTING ACCEPT [15:1140] :DOCKER - [0:0] ---- output trucated---- root@kerneltalks # iptables-save > /root/firewall_rules.backup
So iptables-save is the command with you can take iptables policy backup.
Stop/disable iptables firewall
For older Linux kernels you have an option of stopping service iptables with
service iptables stop but if you are on the new kernel, you just need to wipe out all the policies and allow all traffic through the firewall. This is as good as you are stopping the firewall.
Use below list of commands to do that.
root@kerneltalks # iptables -F root@kerneltalks # iptables -X root@kerneltalks # iptables -P INPUT ACCEPT root@kerneltalks # iptables -P OUTPUT ACCEPT root@kerneltalks # iptables -P FORWARD ACCEPT
- -F: Flush all policy chains
- -X: Delete user-defined chains
- -P INPUT/OUTPUT/FORWARD: Accept specified traffic
Once done, check current firewall policies. It should look like below which means everything is accepted (as good as your firewall is disabled/stopped)
# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
Restore firewall policies
Once you are done with troubleshooting and you want to turn iptables back on with all its configurations. You need to first restore policies from the backup we took in the first step.
root@kerneltalks # iptables-restore </root/firewall_rules.backup
Start iptables firewall
And then start iptables service in case you have stopped it in the previous step using
service iptables start. If you haven’t stopped service then only restoring policies will do for you. Check if all policies are back in iptables firewall configurations :
root@kerneltalks # iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy DROP) target prot opt source destination DOCKER-USER all -- anywhere anywhere DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere -----output truncated-----
That’s it! You have successfully disabled and enabled the firewall without losing your policy rules.
Disable iptables firewall permanently
For disabling iptables permanently follow below process –
- Stop iptables service
- Disable iptables service
- Flush all rules
- Save configuration
This can be achieved using below set of commands.
root@kerneltalks # systemctl stop iptables root@kerneltalks # systemctl disable iptables root@kerneltalks # systemctl status iptables root@kerneltalks # iptables --flush root@kerneltalks # service iptables save root@kerneltalks # cat /etc/sysconfig/iptables