OpenWRT: iptables rules will be deleted automatically

Question

In my OpenWRT instance, I have added iptables rules in the Input filter table, but the problem is when I turn on my system I found that the rules are deleted. What can I do so that the rules are not delete automatically.

Answer 1

OpenWRT

There are a few ways to edit iptables in OpenWRT.

Direct use of iptables

OpenWRT will run the contents of /etc/firewall.user at startup. It is a shell script, so it'll look something like this:

root@OpenWrt:/etc# cat firewall.user 
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 22 -j DNAT --to 10.1.1.1:2222
iptables -A FORWARD -p tcp -d 10.1.1.1 --dport 2222 -j ACCEPT

Testing /etc/firewall.user

After editing the /etc/firewall.user file, you will probably want to test it. This is because you may be able to see any errors if you execute the script at start up. To test the script:

• First, remove any rules affected by the script. A iptables -F will work, but may remove rules you don't need to test.
• Next, run bash /etc/firewall.user. You want to see if there are any errors in the script. If you get any messages back, you probably have a typo.
• Next, run iptables -L and ensure the rules you wanted to be added were added correctly.
• Finally, restart the device. At this point you should expect the rules to be added just as they were last time.

iptables-save and iptables-restore

OpenWRT (along with other distros), have a iptables-save command. By running iptables-save > myrules, you will have a file that contains all that is necessary to restore your iptables rules.

iptables-restore < myrules will read a file of iptables rules and apply them.

So you would need to create a myrules file, and then run iptables-restore < myrules on bootup. You can execute on bootup by editing the /etc/rc.local file.

More information on iptables-save and iptables-restore can be found here.

Use OpenWRTs Firewall Configuration Syntax

The /etc/config/firewall file can be edited as well. The Firewall "provides a configuration interface that abstracts from the iptables system to provide a simplified configuration model that is fit for most regular purposes while enabling the user to supply needed iptables rules on his own when needed."

More information could be found here

Other Distros

Debian or Ubuntu

If you are running Debian or Ubuntu, you can try the iptables-persistent package.

sudo apt-get install iptables-persistent

The above will install the service. It will then save your rules to /etc/iptables/rules.v4 and /etc/iptables/rules.v6.

You can get more info for Ubuntu 12.04 here, Ubuntu 14.04 here.

CentOS

If you are running CentOS, you can save the rules by running:

/sbin/service iptables save 

which will save the contents of iptables to /etc/sysconfig/iptables. The previous content of /etc/sysconfig/iptables will be saved to /etc/sysconfig/iptables.save.

You can get more info here.

Answer 2

You can write a shell script containing all of your iptables commands, then add a line to /etc/rc.local to run the shell script automatically when the system boots. See http://bash.cyberciti.biz/firewall/linux-iptables-firewall-shell-script-for-standalone-server/ for a good tutorial on how to do this.