Automatically loading iptables rules on Debian/Ubuntu

If you want your iptables rules automatically loaded every time your networking comes up on your Debian or Ubuntu server, you can follow these easy steps.

First, get your iptables rules set up the way you like them. Once you’ve verified that everything works, save the rules:

iptables-save > /etc/firewall.conf

Next, open up /etc/network/if-up.d/iptables in your favorite text editor and add the following:

iptables-restore < /etc/firewall.conf

Once you save it, make it executable:

chmod +x /etc/network/if-up.d/iptables

Now, the rules will be restored each time your networking scripts start (or restart). If you need to save changes to your rules in the future, you can manually edit /etc/firewall.conf or you can adjust your rules live and run:

iptables-save > /etc/firewall.conf

Thanks to Ant for this handy tip.


  1. Bartek says

    Thanks for the post but quick question, what’s the difference between doing this and just setting a line in /etc/network/interfaces?

    pre-up iptables-restore < /etc/iptables.up.rules


  2. says


    That method would have the same effect. I normally just try to keep the /etc/network/interfaces clear of extra stuff, but that’s just my own personal preference. ;-)

  3. kit says

    Hi,I have some problems about iptables rules under Ubuntu .
    Is it necessary to create some script llike that to build the firewall,Will the rules got lost when I restart the server.

    I create a simple firewall with the function of NAT,then restart the server.
    type commands below in the terminal:
    iptables -L -v

    But display nothing.
    And it seemd that the NAT function and the rules made last time are still available to use.

    Hoping for your email.

  4. says

    Kit –

    Two have iptables start automatically with your ruleset, you have to do two things: save your ruleset somewhere and apply it at boot time. The documentation above shows you how to do that. If you simply apply your rules and reboot, your rules will be lost as soon as the machine powers down.

  5. Henkske says


    thank you for this howto. It really helped me.

    Do you maybe also have a howto for a dns update script? I need a script that checks my dns adresses every 5 minutes for a ip change and update the FW if the ip is indeed changed.

  6. David Gillies says

    Debian and Ubuntu now offer the iptables-persistent package, which stores IPv4 and IPv6 rules in /etc/iptables/rules.v[4,6] respectively. These are reloaded at boot and can be updated with ip[,6]tables-save > /etc/iptables/iptables.v[4,6]


Leave a Reply

Your email address will not be published. Required fields are marked *