IP Tables won't save the rule.
- by ArchUser
Hello,
I'm using ArchLinux and I have an IP tables rule that I know works (from my other server), and it's in /etc/iptables/iptables.rules, it's the only rule set in that directory. I run, /etc/rc.d/iptables save, then /etc/rc.d/iptables/restart, but when I do "iptables --list", I get ACCEPTs on INPUT,FORWARD & OUTPUT.
# Generated by iptables-save v1.4.8 on Sat Jan 8 18:42:50 2011
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [216:14865]
:BRUTEGUARD - [0:0]
:interfaces - [0:0]
:open - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 18 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 17 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 10 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 9 -j DROP
-A INPUT -p icmp -m icmp --icmp-type 5 -j DROP
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j interfaces
-A INPUT -j open
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -f -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -i eth+ -p icmp -m icmp --icmp-type 8 -j DROP
-A BRUTEGUARD -m recent --set --name BF --rsource
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j LOG --log-prefix "[BRUTEFORCE ATTEMPT] " --log-level 6
-A BRUTEGUARD -m recent --update --seconds 600 --hitcount 20 --name BF --rsource -j DROP
-A interfaces -i lo -j ACCEPT
-A open -p tcp -m tcp --dport 80 -j ACCEPT
-A open -p tcp -m tcp --dport 10011 -j ACCEPT
-A open -p udp -m udp --dport 9987 -j ACCEPT
-A open -p tcp -m tcp --dport 30033 -j ACCEPT
-A open -p tcp -m tcp --dport 8000 -j ACCEPT
-A open -p tcp -m tcp --dport 8001 -j ACCEPT
-A open -s 76.119.125.61 -p tcp -m tcp --dport 21 -j ACCEPT
-A open -s 76.119.125.61 -p tcp -m tcp --dport 3306 -j ACCEPT
-A open -p tcp -m tcp --dport 22 -j BRUTEGUARD
-A open -s 76.119.125.61 -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sat Jan 8 18:42:50 2011
