# iptables + guarddog problem

## Hammett

Hi everyone.

I have a little problem with those 2 programs.

Since firestarter got off the portage tree I decided to give guarddog a try. I set up all the needed rules for having internet as well as msn and irc connections open. The problem comes when I reboot the system.

Although I have a well setup kernel (2.6.18) and iptables loaded at init script, I can't get any connection out. It's not since I start again guarddog and apply again the rules that I have connection. So what I did was:

1.- Configure iptables through guarddog

2.- Save the rules

3.- iptables-save

4.- Reboot computer

No luck. It seems like iptables is not loading all the needed modules to let internet go through iptables. Only when I load again guarddog and apply again the rules it loads a few extra modules (I'm at work, can't remember exact modules) and then everything works like a charm.

Is quite annoying having to run eveytime guarddog just to hava the rules re-applied.

Any hint on solving this?

Thanks in advance

----------

## didymos

Put the necessary modules in /etc/modules.autoload.d/kernel-2.6 so they'll be inserted before iptables runs.

----------

## Hammett

Still no luck.

I put all modules into kernel-2.6 but still can't get any connection in/out if I do not start guarddog manually.

Any hint?

----------

## Hu

You could build the necessary components into your kernel so that they do not need to be probed separately.  Check that the modules service is set to run at boot so that the modules are probed automatically.  Also, please post the rules that are in effect and the modules which are loaded for the correct and incorrect situations.  You can display all the rules at once with iptables-save.  Use lsmod to see the modules.

----------

## Hammett

OK. I've checked everything and looks the same.

Here it goes anyway...

SITUATION A: (don't work)

```

[hammett][/home/hammett] $ lsmod

Module                  Size  Used by

asb100                 17556  4

hwmon_vid               2688  1 asb100

usblp                  10624  0

xt_limit                2432  6

xt_state                2176  59

snd_pcm_oss            36128  0

snd_mixer_oss          13312  1 snd_pcm_oss

snd_seq_oss            25728  0

snd_seq_midi_event      5760  1 snd_seq_oss

snd_seq                38480  4 snd_seq_oss,snd_seq_midi_event

snd_seq_device          6284  2 snd_seq_oss,snd_seq

rfcomm                 28828  6

l2cap                  16260  5 rfcomm

iptable_nat             5892  0

ip_nat                 12844  1 iptable_nat

iptable_mangle          2560  0

iptable_filter          2560  1

ip_tables              10072  3 iptable_nat,iptable_mangle,iptable_filter

ipt_LOG                 5504  6

ipt_REJECT              4096  4

ip_conntrack_ftp        6000  0

ip_conntrack_irc        5488  0

ip_conntrack           35476  5 xt_state,iptable_nat,ip_nat,ip_conntrack_ftp,ip_conntrack_irc

nvidia               7242932  48

hci_usb                13212  6

bluetooth              36324  15 rfcomm,l2cap,hci_usb

snd_intel8x0           25884  1

snd_ac97_codec         79392  1 snd_intel8x0

snd_ac97_bus            2304  1 snd_ac97_codec

snd_pcm                58888  3 snd_pcm_oss,snd_intel8x0,snd_ac97_codec

snd_timer              17156  2 snd_seq,snd_pcm

snd                    37604  11 snd_pcm_oss,snd_mixer_oss,snd_seq_oss,snd_seq,snd_seq_device,snd_intel8x0,snd_ac97_codec,snd_pcm,snd_timer

soundcore               6880  1 snd

snd_page_alloc          7432  2 snd_intel8x0,snd_pcm

pcspkr                  2560  0

i2c_sis96x              4868  0

i2c_core               14992  3 asb100,nvidia,i2c_sis96x

```

```

# Generated by iptables-save v1.3.5 on Thu Aug 16 19:35:10 2007

*nat

:PREROUTING ACCEPT [3939821:527603363]

:POSTROUTING ACCEPT [3060570:167107434]

:OUTPUT ACCEPT [3113506:170511701]

COMMIT

# Completed on Thu Aug 16 19:35:10 2007

# Generated by iptables-save v1.3.5 on Thu Aug 16 19:35:10 2007

*mangle

:PREROUTING ACCEPT [7623022:6532098852]

:INPUT ACCEPT [7622264:6532058829]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [7012510:1209137865]

:POSTROUTING ACCEPT [6954703:1205251241]

COMMIT

# Completed on Thu Aug 16 19:35:10 2007

# Generated by iptables-save v1.3.5 on Thu Aug 16 19:35:10 2007

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:f0to1 - [0:0]

:f0to2 - [0:0]

:f1to0 - [0:0]

:f1to2 - [0:0]

:f2to0 - [0:0]

:f2to1 - [0:0]

:logaborted - [0:0]

:logaborted2 - [0:0]

:logdrop - [0:0]

:logdrop2 - [0:0]

:logreject - [0:0]

:logreject2 - [0:0]

:nicfilt - [0:0]

:s0 - [0:0]

:s1 - [0:0]

:s2 - [0:0]

:srcfilt - [0:0]

-A INPUT -i lo -j ACCEPT

-A INPUT -i eth0 -p udp -m udp --sport 67 --dport 68 -j ACCEPT

-A INPUT -s 192.168.1.101 -d 192.168.1.255 -i eth0 -j ACCEPT

-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags RST RST -j logaborted

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A INPUT -j nicfilt

-A INPUT -j srcfilt

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A FORWARD -j srcfilt

-A OUTPUT -o lo -j ACCEPT

-A OUTPUT -o eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A OUTPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A OUTPUT -j s1

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8080 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8008 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8000 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8888 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 888 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 4661 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 4662 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --sport 1024:65535 --dport 4665 -j ACCEPT

-A f0to1 -p udp -m udp --sport 1024:65535 --dport 4666 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 1863 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8880 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 0:1023 --dport 22 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --dport 53 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 113 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --dport 113 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 6969 -m state --state NEW -j ACCEPT

-A f0to1 -p ah -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 4662 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --sport 1024:65535 --dport 4666 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f0to1 -p icmp -m icmp --icmp-type 0 -j ACCEPT

-A f0to1 -j logdrop

-A f0to2 -j logdrop

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 4662 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --sport 1024:5999 --dport 4666 -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 80 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8080 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8008 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8000 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8888 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 888 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 873 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 2401 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 4661 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 4662 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --sport 1024:5999 --dport 4665 -j ACCEPT

-A f1to0 -p udp -m udp --sport 1024:5999 --dport 4666 -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 3408 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 2234:2240 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 9418 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --dport 6885 -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 1863 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8880 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 443 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 5000 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 3392 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 5052 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 3690 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 995 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --dport 53 -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 6969 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 2710 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 25 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 21 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 110 -m state --state NEW -j ACCEPT

-A f1to0 -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6660:6669 -m state --state NEW -j ACCEPT

-A f1to0 -j logdrop

-A f1to2 -p tcp -m tcp --sport 1024:5999 --dport 3306 -m state --state NEW -j ACCEPT

-A f1to2 -j logdrop

-A f2to0 -j logdrop

-A f2to1 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW -j ACCEPT

-A f2to1 -j logdrop

-A logaborted -m limit --limit 1/sec --limit-burst 10 -j logaborted2

-A logaborted -m limit --limit 2/min --limit-burst 1 -j LOG --log-prefix "LIMITED "

-A logaborted2 -j LOG --log-prefix "ABORTED " --log-tcp-sequence --log-tcp-options --log-ip-options

-A logaborted2 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A logdrop -m limit --limit 1/sec --limit-burst 10 -j logdrop2

-A logdrop -m limit --limit 2/min --limit-burst 1 -j LOG --log-prefix "LIMITED "

-A logdrop -j DROP

-A logdrop2 -j LOG --log-prefix "DROPPED " --log-tcp-sequence --log-tcp-options --log-ip-options

-A logdrop2 -j DROP

-A logreject -m limit --limit 1/sec --limit-burst 10 -j logreject2

-A logreject -m limit --limit 2/min --limit-burst 1 -j LOG --log-prefix "LIMITED "

-A logreject -p tcp -j REJECT --reject-with tcp-reset

-A logreject -p udp -j REJECT --reject-with icmp-port-unreachable

-A logreject -j DROP

-A logreject2 -j LOG --log-prefix "REJECTED " --log-tcp-sequence --log-tcp-options --log-ip-options

-A logreject2 -p tcp -j REJECT --reject-with tcp-reset

-A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable

-A logreject2 -j DROP

-A nicfilt -i eth0 -j RETURN

-A nicfilt -i eth0 -j RETURN

-A nicfilt -i lo -j RETURN

-A nicfilt -j logdrop

-A s0 -d 192.168.1.101 -j f0to1

-A s0 -d 192.168.1.255 -j f0to1

-A s0 -d 127.0.0.1 -j f0to1

-A s0 -d 127.0.0.1 -j f0to2

-A s0 -j logdrop

-A s1 -d 127.0.0.1 -j f1to2

-A s1 -j f1to0

-A s2 -d 192.168.1.101 -j f2to1

-A s2 -d 192.168.1.255 -j f2to1

-A s2 -d 127.0.0.1 -j f2to1

-A s2 -j f2to0

-A srcfilt -s 127.0.0.1 -j s2

-A srcfilt -j s0

COMMIT

# Completed on Thu Aug 16 19:35:10 2007

```

SITUATION B: (already executed Guarddog and applied settings)

```

[hammett][/home/hammett] $ lsmod

Module                  Size  Used by

asb100                 17556  4

hwmon_vid               2688  1 asb100

usblp                  10624  0

xt_limit                2432  6

xt_state                2176  59

snd_pcm_oss            36128  0

snd_mixer_oss          13312  1 snd_pcm_oss

snd_seq_oss            25728  0

snd_seq_midi_event      5760  1 snd_seq_oss

snd_seq                38480  4 snd_seq_oss,snd_seq_midi_event

snd_seq_device          6284  2 snd_seq_oss,snd_seq

rfcomm                 28828  6

l2cap                  16260  5 rfcomm

iptable_nat             5892  0

ip_nat                 12844  1 iptable_nat

iptable_mangle          2560  0

iptable_filter          2560  1

ip_tables              10072  3 iptable_nat,iptable_mangle,iptable_filter

ipt_LOG                 5504  6

ipt_REJECT              4096  4

ip_conntrack_ftp        6000  0

ip_conntrack_irc        5488  0

ip_conntrack           35476  5 xt_state,iptable_nat,ip_nat,ip_conntrack_ftp,ip_conntrack_irc

nvidia               7242932  48

hci_usb                13212  6

bluetooth              36324  15 rfcomm,l2cap,hci_usb

snd_intel8x0           25884  1

snd_ac97_codec         79392  1 snd_intel8x0

snd_ac97_bus            2304  1 snd_ac97_codec

snd_pcm                58888  3 snd_pcm_oss,snd_intel8x0,snd_ac97_codec

snd_timer              17156  2 snd_seq,snd_pcm

snd                    37604  11 snd_pcm_oss,snd_mixer_oss,snd_seq_oss,snd_seq,snd_seq_device,snd_intel8x0,snd_ac97_codec,snd_pcm,snd_timer

soundcore               6880  1 snd

snd_page_alloc          7432  2 snd_intel8x0,snd_pcm

pcspkr                  2560  0

i2c_sis96x              4868  0

i2c_core               14992  3 asb100,nvidia,i2c_sis96x

```

```

# Generated by iptables-save v1.3.5 on Thu Aug 16 19:35:44 2007

*nat

:PREROUTING ACCEPT [3939821:527603363]

:POSTROUTING ACCEPT [3060572:167107554]

:OUTPUT ACCEPT [3113510:170511933]

COMMIT

# Completed on Thu Aug 16 19:35:44 2007

# Generated by iptables-save v1.3.5 on Thu Aug 16 19:35:44 2007

*mangle

:PREROUTING ACCEPT [7623026:6532099052]

:INPUT ACCEPT [7622268:6532059029]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [7012516:1209138177]

:POSTROUTING ACCEPT [6954707:1205251441]

COMMIT

# Completed on Thu Aug 16 19:35:44 2007

# Generated by iptables-save v1.3.5 on Thu Aug 16 19:35:44 2007

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:f0to1 - [0:0]

:f0to2 - [0:0]

:f1to0 - [0:0]

:f1to2 - [0:0]

:f2to0 - [0:0]

:f2to1 - [0:0]

:logaborted - [0:0]

:logaborted2 - [0:0]

:logdrop - [0:0]

:logdrop2 - [0:0]

:logreject - [0:0]

:logreject2 - [0:0]

:nicfilt - [0:0]

:s0 - [0:0]

:s1 - [0:0]

:s2 - [0:0]

:srcfilt - [0:0]

-A INPUT -i lo -j ACCEPT

-A INPUT -i eth0 -p udp -m udp --sport 67 --dport 68 -j ACCEPT

-A INPUT -s 192.168.1.101 -d 192.168.1.255 -i eth0 -j ACCEPT

-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags RST RST -j logaborted

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A INPUT -j nicfilt

-A INPUT -j srcfilt

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A FORWARD -j srcfilt

-A OUTPUT -o lo -j ACCEPT

-A OUTPUT -o eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT

-A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT

-A OUTPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT

-A OUTPUT -j s1

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 0:1023 --dport 22 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --dport 53 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 6969 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 113 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --dport 113 -j ACCEPT

-A f0to1 -p ah -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 888 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8080 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8008 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8000 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8888 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 4661 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 4662 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --sport 1024:65535 --dport 4665 -j ACCEPT

-A f0to1 -p udp -m udp --sport 1024:65535 --dport 4666 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 8880 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 1863 -m state --state NEW -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f0to1 -p icmp -m icmp --icmp-type 0 -j ACCEPT

-A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 4662 -m state --state NEW -j ACCEPT

-A f0to1 -p udp -m udp --sport 1024:65535 --dport 4666 -j ACCEPT

-A f0to1 -j logdrop

-A f0to2 -j logdrop

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 4662 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --sport 1024:5999 --dport 4666 -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 2234:2240 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 3408 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6881:6889 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 995 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --dport 6885 -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 9418 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --dport 53 -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 5052 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 3392 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 5000 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 3690 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 21 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 25 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 6969 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 110 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --dport 2710 -m state --state NEW -j ACCEPT

-A f1to0 -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6660:6669 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 873 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 888 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 80 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8080 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8008 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8000 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8888 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 4661 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 4662 -m state --state NEW -j ACCEPT

-A f1to0 -p udp -m udp --sport 1024:5999 --dport 4665 -j ACCEPT

-A f1to0 -p udp -m udp --sport 1024:5999 --dport 4666 -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 2401 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 443 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8880 -m state --state NEW -j ACCEPT

-A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 1863 -m state --state NEW -j ACCEPT

-A f1to0 -j logdrop

-A f1to2 -p tcp -m tcp --sport 1024:5999 --dport 3306 -m state --state NEW -j ACCEPT

-A f1to2 -j logdrop

-A f2to0 -j logdrop

-A f2to1 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW -j ACCEPT

-A f2to1 -j logdrop

-A logaborted -m limit --limit 1/sec --limit-burst 10 -j logaborted2

-A logaborted -m limit --limit 2/min --limit-burst 1 -j LOG --log-prefix "LIMITED "

-A logaborted2 -j LOG --log-prefix "ABORTED " --log-tcp-sequence --log-tcp-options --log-ip-options

-A logaborted2 -m state --state RELATED,ESTABLISHED -j ACCEPT

-A logdrop -m limit --limit 1/sec --limit-burst 10 -j logdrop2

-A logdrop -m limit --limit 2/min --limit-burst 1 -j LOG --log-prefix "LIMITED "

-A logdrop -j DROP

-A logdrop2 -j LOG --log-prefix "DROPPED " --log-tcp-sequence --log-tcp-options --log-ip-options

-A logdrop2 -j DROP

-A logreject -m limit --limit 1/sec --limit-burst 10 -j logreject2

-A logreject -m limit --limit 2/min --limit-burst 1 -j LOG --log-prefix "LIMITED "

-A logreject -p tcp -j REJECT --reject-with tcp-reset

-A logreject -p udp -j REJECT --reject-with icmp-port-unreachable

-A logreject -j DROP

-A logreject2 -j LOG --log-prefix "REJECTED " --log-tcp-sequence --log-tcp-options --log-ip-options

-A logreject2 -p tcp -j REJECT --reject-with tcp-reset

-A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable

-A logreject2 -j DROP

-A nicfilt -i eth0 -j RETURN

-A nicfilt -i eth0 -j RETURN

-A nicfilt -i lo -j RETURN

-A nicfilt -j logdrop

-A s0 -d 192.168.1.101 -j f0to1

-A s0 -d 192.168.1.255 -j f0to1

-A s0 -d 127.0.0.1 -j f0to1

-A s0 -d 127.0.0.1 -j f0to2

-A s0 -j logdrop

-A s1 -d 127.0.0.1 -j f1to2

-A s1 -j f1to0

-A s2 -d 192.168.1.101 -j f2to1

-A s2 -d 192.168.1.255 -j f2to1

-A s2 -d 127.0.0.1 -j f2to1

-A s2 -j f2to0

-A srcfilt -s 127.0.0.1 -j s2

-A srcfilt -j s0

COMMIT

# Completed on Thu Aug 16 19:35:44 2007

```

Thanks for any help

----------

## oldnavy23

sorry to jump in but i have kinda the same thing guarddog and iptables and when i do the rules and such my apache and everything eles stops working i turn off iptables and all my services  work  i will wait till you get the anwser to your question than i will post my file info to see if i am doing something wrong with mine

----------

## Hu

Both cases have all the same rules, but large groups of rules are in a different place in the guarddog configuration.  What is the output of cat /var/lib/iptables/rules-save?

----------

## oldnavy23

could not get anymore info i was sshing in to box per putty

```

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:f0to1 - [0:0]

:f0to2 - [0:0]

:f1to0 - [0:0]

:f1to2 - [0:0]

:f2to0 - [0:0]

:f2to1 - [0:0]

:logaborted - [0:0]

:logaborted2 - [0:0]

:logdrop - [0:0]

:logdrop2 - [0:0]

:logreject - [0:0]

:logreject2 - [0:0]

:nicfilt - [0:0]

:s0 - [0:0]

:s1 - [0:0]

:s2 - [0:0]

:srcfilt - [0:0]

[0:0] -A INPUT -i lo -j ACCEPT

[0:0] -A INPUT -s 74.95.140.210 -d 74.95.140.215 -i eth0 -j ACCEPT

[0:0] -A INPUT -s 74.95.140.211 -d 74.95.140.215 -i eth0 -j ACCEPT

[0:0] -A INPUT -s 74.95.140.212 -d 74.95.140.215 -i eth0 -j ACCEPT

[0:0] -A INPUT -s 192.168.1.104 -d 192.168.1.255 -i eth1 -j ACCEPT

[0:0] -A INPUT -s 10.1.10.10 -d 10.1.10.255 -i eth2 -j ACCEPT

[0:0] -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -m tcp --tcp-flags RST RST -j logaborted

[4:160] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

[0:0] -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT

[0:0] -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT

[0:0] -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT

[122:7163] -A INPUT -j nicfilt

[122:7163] -A INPUT -j srcfilt

[0:0] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

[0:0] -A FORWARD -p icmp -m icmp --icmp-type 3 -j ACCEPT

[0:0] -A FORWARD -p icmp -m icmp --icmp-type 11 -j ACCEPT

[0:0] -A FORWARD -p icmp -m icmp --icmp-type 12 -j ACCEPT

[0:0] -A FORWARD -j srcfilt

[0:0] -A OUTPUT -o lo -j ACCEPT

[3:120] -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

[0:0] -A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT

[0:0] -A OUTPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT

[0:0] -A OUTPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT

[96:6544] -A OUTPUT -j s1

[0:0] -A f0to1 -p tcp -m tcp --sport 1024:65535 --dport 3900:3999 -m state --state NEW -j ACCEPT

[120:7067] -A f0to1 -j logdrop

[0:0] -A f0to2 -p tcp -m tcp --sport 1024:65535 --dport 3900:3999 -m state --state NEW -j ACCEPT

[0:0] -A f0to2 -j logdrop

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 901 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 1863 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 98 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p udp -m udp --dport 123 -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 123 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 5190:5193 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p udp -m udp --sport 1024:5999 --dport 5190:5193 -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 443 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p udp -m udp --sport 1024:5999 --dport 161 -j ACCEPT

[0:0] -A f1to0 -p udp -m udp --dport 5190 -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 80 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8080 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8008 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8000 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 8888 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 5900:5903 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 5800 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 5050 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 23 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 5000:5001 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p udp -m udp --sport 1024:5999 --dport 5000 -j ACCEPT

[0:0] -A f1to0 -p udp -m udp --dport 514 -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 3306 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 23 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 22 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 0:1023 --dport 22 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 6660:6669 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --dport 445 -m state --state NEW -j ACCEPT

[0:0] -A f1to0 -p tcp -m tcp --sport 1024:5999 --dport 21 -m state --state NEW -j ACCEPT

[96:6544] -A f1to0 -j logdrop

[0:0] -A f1to2 -j logdrop

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 1863 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p udp -m udp --dport 123 -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 123 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 5190:5193 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p udp -m udp --sport 1024:65535 --dport 5190:5193 -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 25 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p udp -m udp --dport 5190 -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 8080 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 8008 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 8000 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 8888 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 5900:5903 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 5800 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 5050 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 23 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 5000:5001 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p udp -m udp --sport 1024:65535 --dport 5000 -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 993 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 22 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 0:1023 --dport 22 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 6660:6669 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 110 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 109 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 143 -m state --state NEW -j ACCEPT

[0:0] -A f2to0 -p udp -m udp --dport 143 -j ACCEPT

[0:0] -A f2to0 -p tcp -m tcp --sport 1024:65535 --dport 23 -m state --state NEW -j logreject

[0:0] -A f2to0 -j logdrop

[0:0] -A f2to1 -j logdrop

[0:0] -A logaborted -j logaborted2

[0:0] -A logaborted2 -j LOG --log-prefix "ABORTED " --log-tcp-sequence --log-tcp-options --log-ip-options

[0:0] -A logaborted2 -m state --state RELATED,ESTABLISHED -j ACCEPT

[218:13707] -A logdrop -j logdrop2

[218:13707] -A logdrop2 -j LOG --log-prefix "DROPPED " --log-tcp-sequence --log-tcp-options --log-ip-options

[218:13707] -A logdrop2 -j DROP

[0:0] -A logreject -j logreject2

[0:0] -A logreject2 -j LOG --log-prefix "REJECTED " --log-tcp-sequence --log-tcp-options --log-ip-options

[0:0] -A logreject2 -p tcp -j REJECT --reject-with tcp-reset

[0:0] -A logreject2 -p udp -j REJECT --reject-with icmp-port-unreachable

[0:0] -A logreject2 -j DROP

[98:4760] -A nicfilt -i eth0 -j RETURN

[0:0] -A nicfilt -i eth0 -j RETURN

[0:0] -A nicfilt -i eth0 -j RETURN

[0:0] -A nicfilt -i eth0 -j RETURN

[0:0] -A nicfilt -i eth0 -j RETURN

[0:0] -A nicfilt -i eth0 -j RETURN

[24:2403] -A nicfilt -i eth1 -j RETURN

[0:0] -A nicfilt -i eth1 -j RETURN

[0:0] -A nicfilt -i eth2 -j RETURN

[0:0] -A nicfilt -i eth2 -j RETURN

[0:0] -A nicfilt -i lo -j RETURN

[0:0] -A nicfilt -j logdrop

[68:3200] -A s0 -d 74.95.140.210 -j f0to1

[0:0] -A s0 -d 74.95.140.215 -j f0to1

[2:120] -A s0 -d 74.95.140.211 -j f0to1

[0:0] -A s0 -d 74.95.140.215 -j f0to1

[28:1440] -A s0 -d 74.95.140.212 -j f0to1

[0:0] -A s0 -d 74.95.140.215 -j f0to1

[12:576] -A s0 -d 192.168.1.104 -j f0to1

[10:1731] -A s0 -d 192.168.1.255 -j f0to1

[0:0] -A s0 -d 10.1.10.10 -j f0to1

[0:0] -A s0 -d 10.1.10.255 -j f0to1

[0:0] -A s0 -d 127.0.0.1 -j f0to1

[2:96] -A s0 -j logdrop

[96:6544] -A s1 -j f1to0

[0:0] -A s2 -d 74.95.140.210 -j f2to1

[0:0] -A s2 -d 74.95.140.215 -j f2to1

[0:0] -A s2 -d 74.95.140.211 -j f2to1

[0:0] -A s2 -d 74.95.140.215 -j f2to1

[0:0] -A s2 -d 74.95.140.212 -j f2to1

[0:0] -A s2 -d 74.95.140.215 -j f2to1

[0:0] -A s2 -d 192.168.1.104 -j f2to1

[0:0] -A s2 -d 192.168.1.255 -j f2to1

[0:0] -A s2 -d 10.1.10.10 -j f2to1

[0:0] -A s2 -d 10.1.10.255 -j f2to1

[0:0] -A s2 -d 127.0.0.1 -j f2to1

[0:0] -A s2 -j f2to0

[122:7163] -A srcfilt -j s0

COMMIT

# Completed on Fri Aug 17 00:51:37 2007

```

----------

## movrev

I'm having the same problem with iptables built into the kernel, so the issue is not loading the modules, as your results seem to confirm. It'd be awesome to fix this issue as it's wearing me thin.

I've switched to guarddog for your exact same reasons and currently keep firestarter installed to quickly see what is being blocked in a more readable format than what is thrown into messages.

----------

## Hu

Your saved rules do not match the rules that are loaded at boot.  The saved rules also do not match the rules loaded by guarddog.  Finally, your saved rules appear to have been saved under a different kernel: the saved rules do not include any reference to the mangle or nat tables, but the rules loaded at boot and the rules loaded by guarddog do have those tables.

You said as step 3 that you "iptables-save".  Did you run iptable-save, or /etc/init.d/iptables save?  The former will print your firewall rules to stdout.  The latter will save the rules for use on subsequent reboots.

----------

## movrev

In my case, I have iptables added at level default in rc-update, which supposedly saves and restores all rules upon rebooting. However, every time I boot up, I need to reapply the rules thru guarddog in order to get the access to the internet I want (aka: the rules I've defined in guarddog).

----------

## Hu

 *movrev wrote:*   

> In my case, I have iptables added at level default in rc-update, which supposedly saves and restores all rules upon rebooting.

 

Only if SAVE_ON_STOP is set to yes in /etc/conf.d/iptables.  I do not recall the default value, but mine is presently set to no.  Is your system configured with SAVE_ON_STOP="yes"?

----------

## movrev

As far as I can remember, these are the default values it came with, but in any case, I do have SAVE_ON_STOP="yes" as the contents of /etc/conf.d/iptables show:

```
# /etc/conf.d/iptables

# Location in which iptables initscript will save set rules on

# service shutdown

IPTABLES_SAVE="/var/lib/iptables/rules-save"

# Options to pass to iptables-save and iptables-restore

SAVE_RESTORE_OPTIONS="-c"

# Save state on stopping iptables

SAVE_ON_STOP="yes"
```

----------

## nicosaturno

guys,

I've got the same problem and I've solved with this little trick posted by jakomo

 *Quote:*   

> 
> 
> I use guarddog but when I started I coudn't get it to set firewall rules on boot, forcing me to manually aply them everytime. Then I found some advice on a thread on the forum that gave me this idea. If you realize that guraddong doesn't apply firewall rules on boot create a script on /etc/init.d with the following:
> 
> ```
> ...

 

hope this helps

----------

