Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual page 749

Tip
To use the same initscript commands to control netfilter for IPv6, substitute ip6tables
for iptables in the /sbin/service commands listed in this section. For more
information about IPv6 and netfilter, refer to
43.9.5.1. IPTables Control Scripts Configuration File
The behavior of the iptables initscripts is controlled by the /etc/sysconfig/iptables-config
configuration file. The following is a list of directives contained in this file:
• IPTABLES_MODULES — Specifies a space-separated list of additional iptables modules to load
when a firewall is activated. These can include connection tracking and NAT helpers.
• IPTABLES_MODULES_UNLOAD — Unloads modules on restart and stop. This directive accepts the
following values:
• yes — The default value. This option must be set to achieve a correct state for a firewall restart or
stop.
• no — This option should only be set if there are problems unloading the netfilter modules.
• IPTABLES_SAVE_ON_STOP — Saves current firewall rules to /etc/sysconfig/iptables when
the firewall is stopped. This directive accepts the following values:
• yes — Saves existing rules to /etc/sysconfig/iptables when the firewall is stopped,
moving the previous version to the /etc/sysconfig/iptables.save file.
• no — The default value. Does not save existing rules when the firewall is stopped.
• IPTABLES_SAVE_ON_RESTART — Saves current firewall rules when the firewall is restarted. This
directive accepts the following values:
• yes — Saves existing rules to /etc/sysconfig/iptables when the firewall is restarted,
moving the previous version to the /etc/sysconfig/iptables.save file.
• no — The default value. Does not save existing rules when the firewall is restarted.
• IPTABLES_SAVE_COUNTER — Saves and restores all packet and byte counters in all chains and
rules. This directive accepts the following values:
• yes — Saves the counter values.
• no — The default value. Does not save the counter values.
• IPTABLES_STATUS_NUMERIC — Outputs IP addresses in numeric form instead of domain or
hostnames. This directive accepts the following values:
• yes — The default value. Returns only IP addresses within a status output.
• no — Returns domain or hostnames within a status output.
IPTables Control Scripts
Section 43.9.6, "IPTables and IPv6".
723