CentOS, Debian: iptables dauerhaft speichern - automatisch laden

Es ist immer nervig, wenn man einen reboot macht und alle iptables-rules sind weg. Bei CentOS (und wahrscheinlich auch bei Fedora, RHEL, Suse - ungetestet) muss man nichts zusätzliches installieren und man kann das Problem mit Boardmitteln lösen.
Bei Debian / Ubuntu kommt iptables-persistent zum Einsatz.

Debian / Ubuntu:

iptables-persistent befindet sich in den Standartrepositories und kann daher einfach mittels

apt-get install iptables-persistent

installiert werden. Alternativ gehts auch manuell, .deb Datei + dpkg -i  iptables-persistent_0.5.7_all.deb.

Die Regeln können jetzt ins Verzeichnis /etc/iptables/rules gespeichert werden und werden bei einem Neustart automatisch geladen. Im Verzeichnis befindet sich auch eine config Datei (iptables.conf) wo man einstellen kann, dass  neue Regeln automatisch gespeichert werden sollen.

/etc/iptables$ cat iptables.conf                                                                                                                                    
# Should new manually added rules from command line be saved on reboot? Assign to a value different that 0 if you want this enabled.                                              
SAVE_NEW_RULES=0         

 Vorhandene Regeln werden mittels iptables-save gespeichert.

iptables-save > /etc/iptables/rules

CentOS

In der Datei /etc/sysconfig/iptables-config kann festgelegt werden, wie mit den Regeln umgegangen werden soll. Die Konfiguration ist selbsterklärend. Für IPv6 Rules steht ip6tables.conf zur Verfügung. Zur veranschaulichung kopiere ich meine config Datei:

sysconfig]# cat iptables-config
# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES=""

# Unload modules on restart and stop
#   Value: yes|no,  default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="yes"

# Save current firewall rules on restart.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets                                                                                                            
# restarted.                                                                                                                                                                      
IPTABLES_SAVE_ON_RESTART="yes"                                                                                                                                                    
                                                                                                                                                                                  
# Save (and restore) rule and chain counter.                                                                                                                                      
#   Value: yes|no,  default: no                                                                                                                                                   
# Save counters for rules and chains to /etc/sysconfig/iptables if                                                                                                                
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or                                                                                                      
# SAVE_ON_RESTART is enabled.                                                                                                                                                     
IPTABLES_SAVE_COUNTER="yes"                                                                                                                                                       
                                                                                                                                                                                  
# Numeric status output                                                                                                                                                           
#   Value: yes|no,  default: yes                                                                                                                                                  
# Print IP addresses and port numbers in numeric format in the status output.                                                                                                     
IPTABLES_STATUS_NUMERIC="yes"                                                                                                                                                     
                                                                                                                                                                                  
# Verbose status output                                                                                                                                                           
#   Value: yes|no,  default: yes                                                                                                                                                  
# Print info about the number of packets and bytes plus the "input-" and                                                                                                          
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
#   Value: yes|no,  default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

Die Regeln befinden sich dann im File /etc/sysconfig/iptables bzw. /etc/sysconfig/ipv6iptables