How to reset Ubuntu 12.04 iptables to default without locking oneself out?

Question

Could anyone kindly provide the commands to completely reset the iptables (firewall) for Ubuntu 12.04 to its default "factory" setting? From what I understand, doing this wrong would cause one to be locked out of the linux box?

Solution 1

Set the default policy on the iptables to ACCEPT:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

Then flush the rules:

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

Note, this will not affect alternate tables, NAT tables, PRE/POST routing tables, etc.

Solution 2

This thing seem to be ok.. http://insanelabs.com/linux/linux-reset-iptables-firewall-rules/

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

Solution 3

Wing's answer will be at your rescue when things go wrong with iptables. If you want to reset everything, including alternate tables, NAT, PRE/POST ROUTING, use this script:

#!/bin/sh
#
# rc.flush-iptables - Resets iptables to default values.
#
# Copyright (C) 2001 Oskar Andreasson <bluefluxATkoffeinDOTnet>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA
#
# Configurations
#
IPTABLES="/sbin/iptables"
#
# reset the default policies in the filter table.
#
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
#
# reset the default policies in the nat table.
#
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
#
# reset the default policies in the mangle table.
#
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
#
# flush all the rules in the filter and nat tables.
#
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
#
# erase all chains that's not default in filter and nat table.
#
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X

Source: Internet Connection Sharing - Ubuntu Help

Comments

[Honey Badger]

Thanks @Wing Tang Wong. Will the above completely return the firewall to its Ubuntu default state? What if I have accidentally changed the other tables? How do I return all tables to default? Thanks!

[Wing Tang Wong]

You can make use of iptables-save and iptables-restore. Basically, dump your iptables config to a file. Make sure the three primary are default ACCEPT, and then delete the other table types from the dump file. Then, import it back into the running system with iptables-restore. That should get you to a clean state. This presumes you can't or don't want to reboot the box.

[Honey Badger]

Gotcha. Question: what if I reboot the box? What will happen? Thanks!

[Wing Tang Wong]

If you disable all iptable rules that would kick off on a reboot, the default rules for a freshly booted box would default to just the three tables in ACCEPT mode. The other tables would disappear. Assuming the rules you were dealing with before were done manually, then a reboot would clear them. However, if they came up that way, then you will need to find and disable/comment out/remove the rules getting installed at startup.

[IsraGab]

The given solution would work only if you didn't install the persistent iptables If you did, you should need to do the folowing comand: sudo apt-get remove iptables-persistent

[Combine]

Man, you don't know how grateful I am for you post!!!! After several hours of painful debugging I finally changed my iptables to default and my problem is now fixed! My problem was that I had nodejs server that worked just fine on localhost:80 and also myip:80 but I also had one more nodejs server that worked on localhost:4000 but didn't worked on myip:4000 and I was very frustrated because this happened after installing mail server on my raspberri pi and this happened all of a sudden. Again man, you have a beer from me! Thank you!

[x-yuri]

Note, this will not affect alternate tables, NAT tables, PRE/POST routing tables, etc. Yeah, a lot is missing. Here's what it looks like if you want to follow this way. And you might want to add iptables -t "$table" -Z. Do note that this way you're hardcoding the list of the tables and their chains. But I'm not sure if the order of the commands is safe. So I would seriously consider save-restore solution. Or you can just unload iptables.

[Nik Burns]

this fixed my server 100% thanks so much