# /etc/init.d/iptables Ignoring New Rules

## wswartzendruber

I have a VPS server I like to keep secure.  Well, I had this old iptables rules script that had things like this: "--option ! condition" instead of like this: "! --option condition".  So iptables on both my ThinkPad and my VPS started complaining.  Well, I fixed the rules on the ThinkPad, ran "./iptables-rules.sh && /etc/init.d/iptables save && /etc/init.d/iptables restart" and it restarted without crying.

But my VPS is a different story:

```
vps ~ # /etc/init.d/iptables restart

* WARNING: you are stopping a boot service

* Stopping firewall...                                                                                                                                                     [ ok ]

* Loading iptables state and starting firewall...

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).                                                          [ ok ]

vps ~ # ./iptables-server.sh 

vps ~ # /etc/init.d/iptables save

* Saving iptables state...                                                                                                                                                 [ ok ]

vps ~ # /etc/init.d/iptables restart

* WARNING: you are stopping a boot service

* Stopping firewall...                                                                                                                                                     [ ok ]

* Loading iptables state and starting firewall...

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).                                                          [ ok ]

vps ~ # 

```

And here's iptables-server.sh:

```
IPTABLES='/sbin/iptables'

IF1='eth0'

# Clear things out.

$IPTABLES -F

$IPTABLES -X

# Setup some anal defaults.

$IPTABLES -P FORWARD DROP

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT ACCEPT

# Setup strict input rules.

$IPTABLES -A INPUT -f -j DROP

$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

$IPTABLES -A INPUT -m state --state INVALID -j DROP

$IPTABLES -A INPUT -p tcp -m state --state NEW -m tcp ! --syn -j DROP

$IPTABLES -A INPUT -s 0.0.0.0/8 -j DROP

$IPTABLES -A INPUT -s 1.0.0.0/8 -j DROP

$IPTABLES -A INPUT -s 2.0.0.0/8 -j DROP

$IPTABLES -A INPUT -s 10.0.0.0/8 -j DROP

$IPTABLES -A INPUT -s 169.254.0.0/16 -j DROP

$IPTABLES -A INPUT -s 192.168.0.0/16 -j DROP

$IPTABLES -A INPUT -s 172.16.0.0/12 -j DROP

$IPTABLES -A INPUT ! -i lo -s 127.0.0.0/8 -j DROP

$IPTABLES -A INPUT -i lo ! -s 127.0.0.0/8 -j DROP

$IPTABLES -A INPUT -i $IF1 -p tcp --dport 22 -j ACCEPT

$IPTABLES -A INPUT -i $IF1 -p tcp --dport 80 -j ACCEPT

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -i lo -j ACCEPT

# Setup lenient output rules.

$IPTABLES -A OUTPUT -f -j DROP

$IPTABLES -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP

$IPTABLES -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP

$IPTABLES -A OUTPUT -m state --state INVALID -j DROP

$IPTABLES -A OUTPUT -p tcp -m state --state NEW -m tcp ! --syn -j DROP

$IPTABLES -A OUTPUT -s 0.0.0.0/8 -j DROP

$IPTABLES -A OUTPUT -s 1.0.0.0/8 -j DROP

$IPTABLES -A OUTPUT -s 2.0.0.0/8 -j DROP

$IPTABLES -A OUTPUT -s 10.0.0.0/8 -j DROP

$IPTABLES -A OUTPUT -s 169.254.0.0/16 -j DROP

$IPTABLES -A OUTPUT -s 192.168.0.0/16 -j DROP

$IPTABLES -A OUTPUT -s 172.16.0.0/12 -j DROP

$IPTABLES -A OUTPUT ! -o lo -s 127.0.0.0/8 -j DROP

$IPTABLES -A OUTPUT -o lo ! -s 127.0.0.0/8 -j DROP
```

Why does it not apply the new placement?  It doesn't complain when I run the new script (unlike before it was updated), but it always complains when loading via init.d.

----------

