Save and Restore Firewall Rules with netfilter-persistent

Reboot a box with unsaved iptables rules and your firewall silently reverts to whatever was there before you touched it. netfilter-persistent gives you a repeatable way to save the currently loaded firewall rules, restore them after a reboot, and flush them only when you mean to remove them. The examples use netfilter-persistent 1.0.20, installed from the netfilter-persistent package.

• Time: about fifteen minutes.
• You need: a shell, the package installed, and a maintenance window if the host is remote or carries live traffic.
• Privileges: commands that change kernel firewall state or write persistent rules need elevation. The read-only checks do not.

1. Check the installed command and configuration

First confirm the binary and package version. This is an ordinary read-only check:

$ command -v netfilter-persistent
/usr/sbin/netfilter-persistent
$ dpkg-query -W -f='${Package} ${Version}\n' netfilter-persistent
netfilter-persistent 1.0.20

• start loads rules.
• stop handles the stop policy.
• flush removes rules.
• save writes the currently loaded rules to persistent storage.
• reload and restart are also accepted by the installed wrapper; both call the plugin start action on this version. Use the documented actions in scripts unless you have checked the wrapper supplied by your distribution.

Read the default configuration before relying on stop:

$ sed -n '1,160p' /etc/default/netfilter-persistent
FLUSH_ON_STOP=0
...

On this installation, FLUSH_ON_STOP=0 means stop warns instead of flushing. A local administrator may have changed that value, and plugins may extend the file, so treat the file as the source of truth.

2. Inspect the rules that are currently loaded

Before saving anything, record what the kernel currently has. These commands only read state:

$ sudo iptables-save
$ sudo ip6tables-save

Both commands print an iptables-save ruleset. The exact chains and rules depend on the host. An empty or very small result is still useful evidence: saving it may replace a more complete rules file. If your firewall is managed by another tool, identify that owner before using this package, because two managers can overwrite each other's rules.

$ sudo sh -c 'iptables-save > /tmp/iptables-current.v4'
$ sudo sh -c 'ip6tables-save > /tmp/iptables-current.v6'

3. Save the loaded rules

$ sudo netfilter-persistent save

The installed iptables plugins save IPv4 rules to /etc/iptables/rules.v4 and IPv6 rules to /etc/iptables/rules.v6, with mode 0640. The package configuration can disable saving for an individual family with IPTABLES_SKIP_SAVE=yes or IP6TABLES_SKIP_SAVE=yes. Check the result without editing it:

$ sudo ls -l /etc/iptables/rules.v4 /etc/iptables/rules.v6
$ sudo iptables-restore --test < /etc/iptables/rules.v4
$ sudo ip6tables-restore --test < /etc/iptables/rules.v6

A successful restore test produces no error and returns status 0. The files are input to the plugins, so preserve them before making manual changes:

$ sudo cp --preserve=all /etc/iptables/rules.v4 /etc/iptables/rules.v4.before-change
$ sudo cp --preserve=all /etc/iptables/rules.v6 /etc/iptables/rules.v6.before-change

4. Load the saved rules deliberately

$ sudo netfilter-persistent start

The wrapper runs every executable in /usr/share/netfilter-persistent/plugins.d with the start argument. The stock plugins load the IPv4 and IPv6 files when present. Confirm the active state afterwards:

$ sudo iptables-save
$ sudo ip6tables-save

Compare the relevant output with the files you intended to load. A command returning successfully proves that the plugin calls completed; it does not prove that the policy is appropriate for your application or that a remote connection will remain reachable.

5. Understand stop, flush and recovery

stop is not the normal way to clear this firewall. With the default configuration it prints a warning such as Automatic flush disabled; use '/usr/sbin/netfilter-persistent flush' and leaves the rules in place. If an administrator has enabled FLUSH_ON_STOP, however, stop can call the plugins' flush action. Check the configuration before using it.

$ sudo netfilter-persistent flush

There is no undo command that reconstructs the previous kernel state. If you saved the intended rules first, reload them:

$ sudo netfilter-persistent start

If the saved files are wrong, restore the backups from step 3 and run the restore tests again before starting. If a load fails, read the plugin error, leave the last known-good backup untouched, and fix the rules file offline. Do not repeatedly flush and start while troubleshooting a remote lockout.

Common traps

• Saving the wrong state. save records what is loaded now, not what you intended to load later. Inspect first.
• Checking only IPv4. IPv6 rules have a separate file and plugin. Test both families when IPv6 is enabled.
• Assuming stop means flush. This installation defaults to FLUSH_ON_STOP=0; another configuration may differ.
• Adding arbitrary options. The wrapper passes one action to each plugin. Plugin-specific configuration belongs in /etc/default/netfilter-persistent or the plugin's own documented files.
• Ignoring ownership. Docker, firewalld, nftables compatibility tools and other managers may also alter netfilter state. Establish which tool owns the rules before enabling boot-time loading.