diff --git a/sources/tech/20180619 How to disable iptables firewall temporarily.md b/sources/tech/20180619 How to disable iptables firewall temporarily.md deleted file mode 100644 index ac60efb433..0000000000 --- a/sources/tech/20180619 How to disable iptables firewall temporarily.md +++ /dev/null @@ -1,106 +0,0 @@ -translating---geekpi - -How to disable iptables firewall temporarily -====== - -Learn how to disable iptables firewall in Linux temporarily for troubleshooting purpose. Also learn how to save policies and how to restore them back when you enable firewall back. - -![How to disable iptables firewall temporarily][1] - -Sometimes you have the requirement to turn off iptables firewall to do some connectivity troubleshooting and then you need to turn it back on. While doing it you also want to save all your [firewall policies][2] as well. In this article, we will walk you through how to save firewall policies and how to disable/enable iptables firewall. For more details about iptables firewall and policies [read our article][3] on it. - -### Save iptables policies - -The first step while disabling iptables firewall temporarily is to save existing firewall rules/policies. `iptables-save` command lists all your existing policies which you can save in a file on your server. - -``` -root@kerneltalks # # iptables-save -# Generated by iptables-save v1.4.21 on Tue Jun 19 09:54:36 2018 -*nat -:PREROUTING ACCEPT [1:52] -:INPUT ACCEPT [1:52] -:OUTPUT ACCEPT [15:1140] -:POSTROUTING ACCEPT [15:1140] -:DOCKER - [0:0] ----- output trucated---- - -root@kerneltalks # iptables-save > /root/firewall_rules.backup -``` - -So iptables-save is the command with you can take iptables policy backup. - -### Stop/disable iptables firewall - -For older Linux kernels you have an option of stopping service iptables with `service iptables stop` but if you are on the new kernel, you just need to wipe out all the policies and allow all traffic through the firewall. This is as good as you are stopping the firewall. - -Use below list of commands to do that. -``` -root@kerneltalks # iptables -F -root@kerneltalks # iptables -X -root@kerneltalks # iptables -P INPUT ACCEPT -root@kerneltalks # iptables -P OUTPUT ACCEPT -root@kerneltalks # iptables -P FORWARD ACCEPT -``` - -Where – - - * -F : Flush all policy chains - * -X : Delete user defined chains - * -P INPUT/OUTPUT/FORWARD : Accept specified traffic - - - -Once done, check current firewall policies. It should looks like below which means everything is accepted (as good as your firewall is disabled/stopped) - -``` -# iptables -L -Chain INPUT (policy ACCEPT) -target prot opt source destination - -Chain FORWARD (policy ACCEPT) -target prot opt source destination - -Chain OUTPUT (policy ACCEPT) -target prot opt source destination -``` - -### Restore firewall policies - -Once you are done with troubleshooting and you want to turn iptables back on with all its configurations. You need to first restore policies from the backup we took in first step. - -``` -root@kerneltalks # iptables-restore /root/firewall_rules.backup +``` + +因此，iptables-save 是可以用来备份 iptables 策略的命令。 + +### 停止/禁用 iptables 防火墙 + +对于较老的 Linux 内核，你可以选择使用 `service iptables stop` 停止 iptables 服务，但是如果你在用新内核，则只需清除所有策略并允许所有流量通过防火墙。这和你停止防火墙效果一样。 + +使用下面的命令列表来做到这一点。 +``` +root@kerneltalks # iptables -F +root@kerneltalks # iptables -X +root@kerneltalks # iptables -P INPUT ACCEPT +root@kerneltalks # iptables -P OUTPUT ACCEPT +root@kerneltalks # iptables -P FORWARD ACCEPT +``` + +这里 – + + * -F：删除所有策略链 + * -X：删除用户定义的链 + * -P INPUT/OUTPUT/FORWARD ：接受指定的流量 + + + +完成后，检查当前的防火墙策略。它应该看起来像下面这样接受所有流量（和禁用/停止防火墙一样） + +``` +# iptables -L +Chain INPUT (policy ACCEPT) +target prot opt source destination + +Chain FORWARD (policy ACCEPT) +target prot opt source destination + +Chain OUTPUT (policy ACCEPT) +target prot opt source destination +``` + +### 恢复防火墙策略 + +故障排除后，你想要重新打开 iptables 的所有配置。你需要先从我们在第一步中执行的备份中恢复策略。 + +``` +root@kerneltalks # iptables-restore