如何暂时禁用 iptables 防火墙
iptables

> 
> 了解如何在 Linux 中暂时禁用 iptables 防火墙来进行故障排除。还要学习如何保存策略以及如何在启用防火墙时恢复它们。
> 
> 
> 


![How to disable iptables firewall temporarily](/data/attachment/album/201806/30/090750t2j8purzppwjj5bq.png)


有时你需要关闭 iptables 防火墙来做一些连接故障排除，然后你需要重新打开它。在执行此操作时，你还需要保存所有[防火墙策略](https://kerneltalks.com/networking/configuration-of-iptables-policies/)。在本文中，我们将引导你了解如何保存防火墙策略以及如何禁用/启用 iptables 防火墙。有关 iptables 防火墙和策略的更多详细信息[请阅读我们的文章](https://kerneltalks.com/networking/basics-of-iptables-linux-firewall/)。


### 保存 iptables 策略


临时禁用 iptables 防火墙的第一步是保存现有的防火墙规则/策略。`iptables-save` 命令列出你可以保存到服务器中的所有现有策略。



```
root@kerneltalks # # iptables-save
# Generated by iptables-save v1.4.21 on Tue Jun 19 09:54:36 2018
*nat
:PREROUTING ACCEPT [1:52]
:INPUT ACCEPT [1:52]
:OUTPUT ACCEPT [15:1140]
:POSTROUTING ACCEPT [15:1140]
:DOCKER - [0:0]
---- output trucated----

root@kerneltalks # iptables-save > /root/firewall_rules.backup

```

因此，iptables-save 是可以用来备份 iptables 策略的命令。


### 停止/禁用 iptables 防火墙


对于较老的 Linux 内核，你可以选择使用 `service iptables stop` 停止 iptables 服务，但是如果你在用新内核，则只需清除所有策略并允许所有流量通过防火墙。这和你停止防火墙效果一样。


使用下面的命令列表来做到这一点。



```
root@kerneltalks # iptables -F
root@kerneltalks # iptables -X
root@kerneltalks # iptables -P INPUT ACCEPT
root@kerneltalks # iptables -P OUTPUT ACCEPT
root@kerneltalks # iptables -P FORWARD ACCEPT

```

这里 –


* `-F`：删除所有策略链
* `-X`：删除用户定义的链
* `-P INPUT/OUTPUT/FORWARD` ：接受指定的流量


完成后，检查当前的防火墙策略。它应该看起来像下面这样接受所有流量（和禁用/停止防火墙一样）



```
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

```

### 恢复防火墙策略


故障排除后，你想要重新打开 iptables 的所有配置。你需要先从我们在第一步中执行的备份中恢复策略。



```
root@kerneltalks # iptables-restore </root/firewall_rules.backup

```

### 启动 iptables 防火墙


然后启动 iptables 服务，以防止你在上一步中使用 `service iptables start` 停止了它。如果你已经停止服务，那么只有恢复策略才能有用。检查所有策略是否恢复到 iptables 配置中：



```
#  iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
-----output truncated-----

```

就是这些了！你已成功禁用并启用了防火墙，而不会丢失你的策略规则。




---


via: <https://kerneltalks.com/howto/how-to-disable-iptables-firewall-temporarily/>


作者：[kerneltalks](https://kerneltalks.com) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
*Learn how to disable the iptables firewall in Linux temporarily for troubleshooting purposes. Also, learn how to save policies and how to restore them back when you enable the firewall back.*

![](https://z5.kerneltalks.com/wp-content/uploads/2020/06/How-to-disable-iptables-firewall-temporarily.png)

Sometimes you have the requirement to turn off the iptables firewall to do some connectivity troubleshooting and then you need to turn it back on. While doing it you also want to save all your [firewall policies](https://kerneltalks.com/networking/configuration-of-iptables-policies/) as well. In this article, we will walk you through how to save firewall policies and how to disable/enable an iptables firewall. For more details about the iptables firewall and policies [read our article](https://kerneltalks.com/networking/basics-of-iptables-linux-firewall/) on it.

#### Save iptables policies

The first step while disabling the iptables firewall temporarily is to save existing firewall rules/policies. `iptables-save`

command lists all your existing policies which you can save in a file on your server.

```
root@kerneltalks # iptables-save
# Generated by iptables-save v1.4.21 on Tue Jun 19 09:54:36 2018
*nat
:PREROUTING ACCEPT [1:52]
:INPUT ACCEPT [1:52]
:OUTPUT ACCEPT [15:1140]
:POSTROUTING ACCEPT [15:1140]
:DOCKER - [0:0]
---- output trucated----
root@kerneltalks # iptables-save > /root/firewall_rules.backup
```

So iptables-save is the command with you can take iptables policy backup.

#### Stop/disable iptables firewall

For older Linux kernels you have an option of stopping service iptables with `service iptables stop`

but if you are on the new kernel, you just need to wipe out all the policies and allow all traffic through the firewall. This is as good as you are stopping the firewall.

Use below list of commands to do that.

```
root@kerneltalks # iptables -F
root@kerneltalks # iptables -X
root@kerneltalks # iptables -P INPUT ACCEPT
root@kerneltalks # iptables -P OUTPUT ACCEPT
root@kerneltalks # iptables -P FORWARD ACCEPT
```

Where –

- -F: Flush all policy chains
- -X: Delete user-defined chains
- -P INPUT/OUTPUT/FORWARD: Accept specified traffic

Once done, check current firewall policies. It should look like below which means everything is accepted (as good as your firewall is disabled/stopped)

```
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
```

### Restore firewall policies

Once you are done with troubleshooting and you want to turn iptables back on with all its configurations. You need to first restore policies from the backup we took in the first step.

```
root@kerneltalks # iptables-restore </root/firewall_rules.backup
```

### Start iptables firewall

And then start iptables service in case you have stopped it in the previous step using `service iptables start`

. If you haven’t stopped service then only restoring policies will do for you. Check if all policies are back in iptables firewall configurations :

```
root@kerneltalks # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
-----output truncated-----
```

That’s it! You have successfully disabled and enabled the firewall without losing your policy rules.

#### Disable iptables firewall permanently

For disabling iptables permanently follow below process –

- Stop iptables service
- Disable iptables service
- Flush all rules
- Save configuration

This can be achieved using below set of commands.

```
root@kerneltalks # systemctl stop iptables
root@kerneltalks # systemctl disable iptables
root@kerneltalks # systemctl status iptables
root@kerneltalks # iptables --flush
root@kerneltalks # service iptables save
root@kerneltalks # cat /etc/sysconfig/iptables
```

Except you don’t really have to delete the user defined chains… They’re isolated once the main chains are cleared

If your policies have DROP as a policy you will lock yourself out of the box with those commands

just did… LOL.

this just bit me hard. this was a machine that was only accessible remotely, at least for the next month.

kerneltalks is temporarily my sworn enemy.

Same here. Awful advice.

FIX THIS. ADD A WARNING.