/commands/iptables/iptables-save-restore-persist
Save iptables rules permanently: iptables-save, iptables-restore and persistence after reboot
- tool
- iptables / nftables
- versions
- iptables 1.8, Debian/Ubuntu iptables-persistent, RHEL iptables-services
- os
- linux
Rules added with iptables live only in the kernel and are lost at reboot. Save them with sudo iptables-save > rules.v4 and load them with sudo iptables-restore < rules.v4. To load them automatically at boot, install the distribution's service: on Debian and Ubuntu, iptables-persistent (sudo netfilter-persistent save writes /etc/iptables/rules.v4 and rules.v6); on RHEL, Rocky and AlmaLinux, iptables-services (sudo service iptables save writes /etc/sysconfig/iptables).
When to use which
Use iptables-save and iptables-restore whenever you want a snapshot of the current ruleset: before an experiment, to move rules to another host, or to keep them in version control. Use the persistence package when the rules must come back by themselves after every reboot. Both work with the same text format, so a file saved by hand can become the boot-time file.
Options you will use
| Option | Command | What it does |
|---|---|---|
| -t TABLE | iptables-save | Save only one table (filter, nat, mangle, raw, security) instead of all of them. |
| -c | both | Include packet and byte counters when saving, or restore them when loading. |
| -f FILE | iptables-save | Write to FILE instead of standard output. |
| -t / --test | iptables-restore | Parse the input and build the ruleset, but do not commit it. Use it to check a file before loading. |
| -n / --noflush | iptables-restore | Do not flush the tables in the input before loading; rules are appended to what is there. |
| -w SECONDS | iptables-restore | Wait for the xtables lock instead of failing with Another app is currently holding the xtables lock. |
Note that -t means "table" for iptables-save but "test" for iptables-restore.
Save and restore by hand
sudo iptables-save > rules.v4 # all tables, as iptables-restore input
sudo ip6tables-save > rules.v6
sudo iptables-restore --test < rules.v4 # parse and check without applying
sudo iptables-restore < rules.v4 # replace the current rules atomically
sudo iptables-restore --noflush < extra.v4 # add without flushing existing chainsiptables-restore applies a whole table in one transaction: either every rule loads or none does, which is safer than running many iptables commands in a script.
Debian and Ubuntu
sudo apt install iptables-persistent # asks whether to save the current rules
sudo netfilter-persistent save # writes /etc/iptables/rules.v4 and rules.v6
sudo netfilter-persistent reload # loads them again
systemctl status netfilter-persistent # loaded at boot by this serviceRHEL, Rocky, AlmaLinux, Fedora
sudo dnf install iptables-services
sudo systemctl disable --now firewalld # firewalld and iptables-services must not both manage rules
sudo systemctl enable --now iptables
sudo service iptables save # writes /etc/sysconfig/iptablesThe file format
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
COMMITEach table starts with *name and ends with COMMIT; :CHAIN POLICY [packets:bytes] lines set the policies. You can edit the file and load it with iptables-restore.
Pitfalls
- Locking yourself out. Restoring a file with
:INPUT DROPand no rule for your SSH port cuts the session. Test with--testfirst and keep a console or a scheduled rollback available on remote machines. - Legacy versus nf_tables backend.
iptables --versionprints(nf_tables)or(legacy). Rules saved with one backend should be restored with the same one (iptables-legacy-saveandiptables-nft-saveexist side by side on Debian); see iptables vs nftables. - Missing chains or targets. A file that references a chain created by another tool is rejected and
iptables-restorenames the line that failed; see No chain/target/match by that name. - Inspect before saving.
iptables -L -n --line-numbersshows what you are about to store.
FAQ
Where does iptables-save write the rules?
To standard output. Redirect it to a file yourself, or use -f FILE. Nothing is saved to disk unless you redirect the output or use a persistence service.
Do I need to save IPv6 rules separately?
Yes. iptables-save covers only IPv4. Run ip6tables-save for IPv6; netfilter-persistent writes rules.v6 next to rules.v4, and iptables-services uses /etc/sysconfig/ip6tables.
Why are my saved rules missing after reboot even though the file exists?
Usually nothing loads the file at boot: the netfilter-persistent or iptables service is not enabled, or another firewall manager (firewalld, ufw) starts later and replaces the rules. Check the service with systemctl status.