Use CUSTOMINPUT, CUSTOMFORWARD and CUSTOMOUTPUT for the filter table. Packets pass these chains BEFORE they go through the rest of the ruleset. Instead of altering the default iptables chains (which can be very dangerous when the firewall ruleset does not work as intended), there are extra chains that MUST be used for this. Those should be added in the 'start' section and be removed correspondingly in the 'stop' section.ĭespite adding firewall rules, you may also start and stop system services or do anything else that can be done from a Linux shell.

This is usually used for adding additional iptables rules.

Now, when listing the rules, the rule to allow HTTP is no longer listed, because we restored iptables from the /etc/sysconfig/iptables file.# /etc/sysconfig/firewall.local Usage : / etc / sysconfig / firewall. iptables-restore < /etc/sysconfig/iptables Let's issue the iptables-restore command.

However, the /etc/sysconfig/iptables file will not include the rule to allow HTTP, since the iptables-save command was not used after adding the rule to allow HTTP. Pkts bytes target prot opt in out source destinationĠ 0 ACCEPT all - lo any anywhere anywhereĠ 0 ACCEPT tcp - any any anywhere anywhere tcp dpt:http Now, when you use the list the iptables rules, the rule to allow HTTP on port 80 will be listed. iptables -I INPUT -p tcp -dport 80 -j ACCEPT In this example, a rule is added to allow HTTP on port 80. Now let's say you add a rules to iptables. A OUTPUT -p tcp -m tcp -sport 22 -m conntrack -ctstate ESTABLISHED -j ACCEPT A INPUT -p icmp -m icmp -icmp-type 8 -j ACCEPT A INPUT -s 192.168.0.0/24 -p tcp -m tcp -dport 22 -m conntrack -ctstate NEW,ESTABLISHED -j ACCEPT The /etc/sysconfig/iptables file will now have something like this. Let's say you have used the iptables-save command to save your current iptables rules to the /etc/sysconfig/iptables file, like this.

Iptables reload