Will my site be stopped during an iptables restart?
By default, no. The /etc/init.d/iptables
script does the following on restart:
restart() {
[ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
stop
start
}
Notwithstanding the issue of saving the existing rules, the effect of an unmodified stop
is to disable all the rules:
[root@bill ~]# service iptables stop
iptables: Setting chains to policy ACCEPT: mangle nat filte[ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
[root@bill ~]# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
And assuming that either (a) you're saving the rules on stop
, and your existing rules are what you want, or (b) you don't save the rules on stop
, and your proposed ruleset in /etc/sysconfig/iptables
is syntactically and functionally correct, when the start
puts the rules back in place, service should continue uninterrupted.
The state table is not affected by stopping the firewall rules, so any traffic that was being allowed through by stateful rules before the stop
should continue to be so after the start
. NAT rules do get (temporarily) erased by a stop
, though, so if you're using NAT then that may be affected by a restart.