So, I wanted to persist/save iptables rules on ubuntu...
I made the mistake of using ubuntu for no other reason than I’m using vagrant and that’s what they use in their documentation.
I’m usually a CentOS kinda guy.
Whenever I set up a new server I like to set iptables rules, because.. you know... firewalls are a good idea. Â
And when I set these rules, I want them to load every time the server starts. Â Because, you know... firewalls are a good idea.
The good people over at CentOS (RH) seem to agree and have made this very easy. `service iptables save`. Â Boom. Â Done. Â
Now... let’s talk about ubuntu (debian).  Fuck debian. Â
So how do you get the rules to save?
Well, you could read this ridiculously long community entry on the SO>ubuntu wiki.  I did, and tried the first version to find it didn’t work.
Why didn’t it work?  I have no idea, but it didn’t.  I didn’t try the second, because... it’s the second, and it seemed hackish to me.
Let’s give lucky #3 a go because I’ve seen iptables-persistent mentioned elsewhere.
The first thing you’ll notice about iptables-persistent is that it doesn’t install silently, and thus can’t be scripted as-is.  Groan.
After some searching, I learned that you’ll need to do this to get it to STFU.
It seems to work, except the apt-get install breaks the vagrant provisioning process by causing it to hang.  It’ll still go on provisioning, but vagrant never sees it complete.  (this is a clue i think, but i’m still coming up empty)
No manner of bash trickery can unfuck what the iptables-persistent install fucks during the vagrant provisioning process.
And that’s where I’m at.  I’ll post an update once I have it fixed.... .. . ... .. ...... Â
Or I’ll just rewrite everything to work on CentOS instead, which I probably could’ve done by now if I only knew all this going in.
The final vagrant provisioning hanging was related to the SSH connection going away after the firewall rules were applied. Â (i.e. firewall blocked ssh but vagrant still thought it was connected.)
My iptables rules included a default DROP policy which seems like it was at least part of the problem. Â After removing this I was able to get things working, though I do not like it not being there... Â
I wasn’t able to find any info on why this doesn’t work on ubuntu, but I did find this page on debian’s wiki that doesn’t include a default ACCEPT or DROP policy at all? Â
I care not, because this is my first and last experience with ubuntu server. Â :)
Here’s some reading material on saving iptables rules:
http://askubuntu.com/questions/339790/how-can-i-prevent-apt-get-aptitude-from-showing-dialogs-during-installation
https://www.thomas-krenn.com/en/wiki/Saving_Iptables_Firewall_Rules_Permanently
http://askubuntu.com/questions/339790/how-can-i-prevent-apt-get-aptitude-from-showing-dialogs-during-installation