iptables-save — Dump firewall rules

Linux / Network and Firewall / iptables-save.html

Prints the active iptables rule set in a text form that can be restored later.

Basic Information

What is this command?

iptables-save reads the live rules and prints them in the format iptables-restore accepts.

It is the standard way to back up rules before a change or copy them to another host.

What problems does it solve?

• Back up the live rule set before changing it.
• Compare firewall policy between servers.
• Feed snapshots into automation.
• Keep a history of rule changes.

Key features

Full dump

With no arguments it prints every table to standard output.

• When to use: When skimming the rules on screen.
• What you get: Restorable text is printed.
• Limitations: Output is long and better saved to a file.

Save to file

Use redirection to create a backup file.

• When to use: When snapshotting before a change.
• What you get: The rule set at that moment is preserved.
• Limitations: Unrestricted file permissions expose the policy.

Select a table

Use -t to dump one table only.

• When to use: When only NAT rules matter.
• What you get: Only that table is printed.
• Limitations: A wrong table name raises an error.

Installation and usage

Check whether it is installed

iptables-save --version

sudo apt install iptables

Real-world examples

Full backup

Save every rule to a file.

sudo iptables-save > /root/iptables.backup

NAT only

Dump the NAT table only.

sudo iptables-save -t nat

Count rules

Count rule lines in the backup.

grep -c '^-A' /root/iptables.backup