Hi Scott, The important file for iptables which will be loaded at startup is in /etc/sysconfig/iptables
It is basically the same information you have in the firewall script, but in a slightly different syntax. Perhaps you need to check if that file is on the system and has valid content? It should look something like this: # Generated by iptables-save v1.3.5 on Thu Sep 9 17:00:22 2010 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [12:1444] -A INPUT -i eth0 -f -j DROP -A INPUT -s 127.0.0.0/255.0.0.0 -i ! lo -j DROP -A INPUT -s 10.0.0.0/255.0.0.0 -i ! lo -j DROP -A INPUT -s 172.16.0.0/255.240.0.0 -i ! lo -j DROP -A INPUT -s 192.168.0.0/255.255.0.0 -i ! lo -j DROP -A INPUT -s 224.0.0.0/240.0.0.0 -i ! lo -j DROP -A INPUT -s 240.0.0.0/240.0.0.0 -i ! lo -j DROP -A INPUT -s 0.0.0.0/255.0.0.0 -i ! lo -j DROP -A INPUT -s 255.255.255.255 -i ! lo -j DROP -A INPUT -s 169.254.0.0/255.255.0.0 -i ! lo -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 25 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 110 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset -A INPUT -p tcp -m tcp --dport 143 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 587 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 993 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 995 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -p tcp -m tcp --dport 5667 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A INPUT -m state --state NEW -j REJECT --reject-with icmp-port-unreachable -A OUTPUT -o lo -j ACCEPT -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Thu Sep 9 17:00:22 2010 From: Scott Hughes Sent: Thursday, November 11, 2010 5:40 PM To: [email protected] Subject: [qmailtoaster] iptables firewall issue All, I continue to have strange firewall issues. The iptables firewall is acting normal EXCEPT when the system gets restarted. Then it is like it goes back to some default setting and I have log into the console and manually run the firewall.sh script. The script automatically saves the settings with 'service iptables save' and I have run this manually as well. Still having the same issue. Anyone out there have any ideas that might save my firewall settings though restarts/reboots? Thanks, Scott
