iptables settings not reloaded [solved]

[meranto]

I use "guarddog" as my GUI configuration utility for my iptables-firewall. This works very well, but the firewall rules do not get loaded until I run guarddog and apply the settings. This is very irritating because I have to run "guarddog" everytime after I reboot in order to keep my system safe.

I have put "iptables" and "firestarter" in my default runlevel, but if I restart them both, my firewall rules are wiped until I start "guarddog" again and apply the settings.

If anyone is interested in the "iptables -L" output, here it is:

everything shut down:

[limn]

iptablesby default should save the settings at shutdown.
Check
/etc/conf.d/iptables
Perhaps firestarter is shutting down before iptables and confusing things.
If firestarter is not adding to the rules, try turning it off.

[magic919]

Once you have them all set up as you wish do

[meranto]

One part solved:

I removed "firestarter" from the default runlevel and ran "/etc/init.d/iptables save". After a reboot all my rules were applied, BUT.....

I couldn't use anything.... All ports were blocked, I couldn't browse the internet or get my mail is UNTIL I ran "guarddog" again and appied the settings.

After I ran "/etc/init.d/iptables stop" and "/etc/init.d/iptables start" everything still works fine, but after a reboot I does not.....

Does it look like my system is goofed up with firewalls?

[magic919]

It looks like might want to read and try what I posted above.

Get the firewall working to your satisfaction. At this point the iptables are ok.

Save the tables.

Enjoy.

[meranto]

[magic919]

I think we need to see what is happening with IPTables - and not be checking with Fireguard and Dogstarter.

Get the firewall working and fine using the tools of your choice.

Run iptables -L -n -v and do a copy a paste the output somewhere.

Do the /etc/init.d/iptables save.

Reboot.

Make sure /etc/init.d/iptables is running

Run iptables -L -n -v and compare.

I'd like to know what is blocking the ports if all your rules are applied.

[meranto]

I followed your post exactly:

Before I reboot:

[meranto]

Here are the last few lines of my "/var/log/messages"

You can see that outgoing traffic is rejected.....

[Cintra]

Have a look for radfoj's post in this thread for a workaround
https://forums.gentoo.org/viewtopic-t-159971-highlight-radfoj.html
mvh
_________________
"I am not bound to please thee with my answers" W.S.

[magic919]

Your rules are killing off new stuff to Port 80, for example. S1 and then f1to0 needs src port <6000 and you are trying to come from a higher source port.

Probably the same elsewhere as it only lets related and established directly. The other bits, poorly done, kill the new stuff if it doesn't fit the criteria.

[meranto]

[Cintra]

Good for you
Mvh
_________________
"I am not bound to please thee with my answers" W.S.

[magic919]

Glad you got that sorted. Given that iptables do the firewalling there are a surprisingly large number of front ends to manipulate them. Problem is that IPtables puts the fear of god into many. If this wasn't the case we'd have fewer magic scripts and so on.

I don't think IPTables is too bad but there's definitely some room for something else.

[MaDxRaY]

Hi,