The iptables-save command is, as we have already
explained, a tool to save the current rule-set into a file that
iptables-restore can use. This command is quite simple
really, and takes only two arguments. Take a look at the following
example to understand the syntax of the command.
iptables-save [-c] [-t table]
The -c argument tells iptables-save
to keep the values specified in the byte and packet counters. This could
for example be useful if we would like to reboot our main firewall, but
not lose byte and packet counters which we may use for statistical
purposes. Issuing a iptables-save command with the
-c argument would then make it possible for us to
reboot without breaking our statistical and accounting routines. The
default value is, of course, to not keep the counters intact when issuing
this command.
The -t argument tells the
iptables-save command which tables to save. Without
this argument the command will automatically save all tables available
into the file. The following is an example on what output you can expect
from the iptables-save command if you do not have any
rule-set loaded.
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
*filter
:INPUT ACCEPT [404:19766]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [530:43376]
COMMIT
# Completed on Wed Apr 24 10:19:17 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
*mangle
:PREROUTING ACCEPT [451:22060]
:INPUT ACCEPT [451:22060]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [594:47151]
:POSTROUTING ACCEPT [594:47151]
COMMIT
# Completed on Wed Apr 24 10:19:17 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [3:450]
:OUTPUT ACCEPT [3:450]
COMMIT
# Completed on Wed Apr 24 10:19:17 2002
This contains a few comments starting with a # sign. Each table is marked
like *<table-name>, for example
*mangle. Then within each table we have
the chain specifications and rules. A chain specification looks like
:<chain-name> <chain-policy>
[<packet-counter>:<byte-counter>]. The
chain-name may be for example
PREROUTING, the policy is described previously
and can, for example, be ACCEPT. Finally the
packet-counter and byte-counters are the same counters as in the output
from iptables -L -v. Finally, each table declaration
ends in a COMMIT keyword. The
COMMIT keyword tells us that at this
point we should commit all rules currently in the pipeline to kernel.
The above example is pretty basic, and hence I believe it is nothing more
than proper to show a brief example which contains a very small Iptables-save ruleset.
If we would run iptables-save on
this, it would look something like this in the output:
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
*filter
:INPUT DROP [1:229]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Apr 24 10:19:55 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
*mangle
:PREROUTING ACCEPT [658:32445]
:INPUT ACCEPT [658:32445]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [891:68234]
:POSTROUTING ACCEPT [891:68234]
COMMIT
# Completed on Wed Apr 24 10:19:55 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
*nat
:PREROUTING ACCEPT [1:229]
:POSTROUTING ACCEPT [3:450]
:OUTPUT ACCEPT [3:450]
-A POSTROUTING -o eth0 -j SNAT --to-source 195.233.192.1
COMMIT
# Completed on Wed Apr 24 10:19:55 2002
As you can see, each command has now been prefixed with the byte and
packet counters since we used the -c argument. Except
for this, the command-line is quite intact from the script. The only
problem now, is how to save the output to a file. Quite simple, and you
should already know how to do this if you have used linux at all before.
It is only a matter of piping the command output on to the file that you
would like to save it as. This could look like the following:
iptables-save -c > /etc/iptables-save
The above command will in other words save the whole rule-set to a file
called /etc/iptables-save with byte and packet
counters still intact.
