One of the most frequent traps junior Linux administrators encounter when configuring network security is failing to make firewall rules persistent. When you add packet-filtering rules using standard iptables or modern nftables command-line tools, the rules are injected strictly into ephemeral Linux kernel RAM memory. The instant the server restarts, undergoes a scheduled kernel update, or recovers from a power disruption, all active firewall chains vanish, leaving services unprotected. Mastering iptables-save, iptables-restore, and nftables atomic configuration files guarantees uninterrupted network security across reboots.
How iptables and nftables Handle State in Memory
Both packet-filtering frameworks operate at the kernel level (via Netfilter subsystem hooks). Because kernel execution state resets on reboot, user-space utilities must dump active table structures into static text configuration files on the root partition and reload them during early systemd boot phases.
Part 1: Making Legacy iptables Rules Persistent
1. Exporting Active Rules via iptables-save
To dump all currently active IPv4 firewall rules (including filter, nat, and mangle tables) into a standardized persistent text file, run:
sudo iptables-save | sudo tee /etc/iptables.rulesFor IPv6 rules, run the companion IPv6 command:
sudo ip6tables-save | sudo tee /etc/ip6tables.rules2. Manually Restoring Rules via iptables-restore
To flush existing rules and atomically inject the saved ruleset back into the running Linux kernel:
sudo iptables-restore < /etc/iptables.rulesPassing the -c (counters) flag preserves packet and byte packet counters across reloads.
3. Automating Persistence on Ubuntu and Debian (iptables-persistent)
On Debian-based distributions, install the automated systemd persistence package:
sudo apt update && sudo apt install -y iptables-persistent netfilter-persistentWhenever you update rules in memory, save them permanently across boots by running:
sudo netfilter-persistent save
sudo systemctl enable netfilter-persistentPart 2: Modern nftables Configuration Persistence
Modern Linux distributions—including Debian 12, Ubuntu 24.04, and RHEL 9—have replaced iptables with nftables as the default Netfilter backend. nftables uses a unified hierarchical syntax and native atomic rule loading.
1. Auditing the Active nftables Ruleset
To view your live ruleset in structured nftables syntax:
sudo nft list ruleset2. Saving nftables Rules to the Master Configuration File
On modern distributions, the systemd nftables.service automatically reads from /etc/nftables.conf on startup. To overwrite this file with your verified live ruleset:
sudo nft list ruleset | sudo tee /etc/nftables.conf3. Verifying and Testing nftables Rulesets Atomically
Unlike iptables which applies rules line-by-line, nftables supports atomic compilation and syntax verification. You can test your saved file for syntax errors before activating it:
sudo nft -c -f /etc/nftables.confThe -c (check) parameter parses the entire configuration in memory; if a syntax error exists, it reports the problem without breaking live traffic.
4. Enabling the nftables Systemd Service
To ensure systemd reloads /etc/nftables.conf on every system boot:
sudo systemctl enable --now nftablesComparison: iptables vs. nftables Persistence
| Feature | iptables Framework | nftables Framework |
|---|---|---|
| Default Config File | /etc/iptables/rules.v4 |
/etc/nftables.conf |
| Protocol Unification | Separate (iptables vs ip6tables) | Unified (inet family handles IPv4 & IPv6) |
| Reload Atomicity | Partial (Sequential table loading) | 100% Atomic transaction |
| Pre-Flight Syntax Check | No (Fails mid-execution) | Yes (nft -c -f verifies syntax) |