ip6tables-restore: Restore IPv6 firewall rules

ip6tables-restore

A practical tool to load IPv6 firewall rules from a previously saved file. Think of it as the counterpart to ip6tables-save for reapplying rules in bulk.

Quick start

  • Restore rules from a file:
sudo ip6tables-restore < /path/to/rules.v6

  • Important: the file should be in the same format produced by ip6tables-save, with proper table and chain declarations.

  • If you want to see the current rules before restoring:

sudo ip6tables-save

How to generate a compatible file

If you already have a running IPv6 firewall, you can snapshot it with:

sudo ip6tables-save > /path/to/rules.v6

This file can then be used with ip6tables-restore to reproduce the same setup on boot or after networking changes.

Common usage patterns

  • Restore into a fresh state (replace current rules):
sudo ip6tables-restore < /path/to/rules.v6
  • Restore while keeping a default policy (example: drop all by default and then allow specific traffic):
# Ensure default policy is set as desired before restoring
sudo ip6tables -P INPUT DROP
sudo ip6tables-restore < /path/to/rules.v6
  • Test restoration safely by wrapping in a script that backs up current rules first:
#!/bin/sh
sudo ip6tables-save > /root/backup-ip6tables-$(date +%F).v6
sudo ip6tables-restore < /path/to/rules.v6

Common pitfalls

  • Permissions: ip6tables-restore must run as root or with sudo; otherwise you’ll get a permission error.
  • File format: The restore file must be compatible with ip6tables. A mismatched format or stray characters can corrupt the configuration.
  • State vs. boot: Restoring may drop current rules depending on how you structure the file. If you want a clean slate, reset policies and chains first.
  • Saving vs restoring: ip6tables-save captures the runtime state, which might include dynamic rules; restore blindly can overwrite your intended configuration. Always review the file or test in a safe environment.

Troubleshooting tips

  • If restore fails with a line-numbered error, open the file and fix the indicated line. The file format is a stream of table and rule commands with no extraneous syntax.
  • Use —verbose when debugging in some environments:
sudo ip6tables-restore -v < /path/to/rules.v6
  • After restoring, verify the active rules:
sudo ip6tables -L -v

When to use ip6tables-restore vs. ip6tables-apply

  • Use ip6tables-restore when you have a pre-defined, multi-rule configuration saved from ip6tables-save and you want to apply it in one go.
  • Use ip6tables (and related commands) for ad-hoc rule changes or fine-grained manipulations on individual chains.

Quick reference

  • Restore from a file:
sudo ip6tables-restore < /path/to/rules.v6
  • Preview the rules before applying:
sudo ip6tables-save
  • Save the current rules for backup:
sudo ip6tables-save > /path/to/backup.v6

Takeaways

  • ip6tables-restore is a bulk loader for IPv6 firewall rules saved with ip6tables-save. Prepare your file carefully, run with appropriate privileges, and verify the resulting configuration to avoid accidental lockouts or misconfigurations.

See Also