# Iptables, ipset

**URL:** <https://forum.opennebula.io/t/iptables-ipset/12446>\
**Category:** Product Support\
**Tags:** release\
**Created:** [September 18, 2024, 9:00am UTC](https://forum.opennebula.io/t/iptables-ipset/12446 "2024-09-18T09:00:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![albert.khassanov](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/albert.khassanov/32/8233_2.png) [@albert.khassanov](https://forum.opennebula.io/u/albert.khassanov)\
**Post date:** [September 18, 2024, 9:00am UTC](https://forum.opennebula.io/t/iptables-ipset/12446/1 "2024-09-18T09:00:16Z")

</div>

Please, describe the problem here and provide additional information below (if applicable) …

* * *

AlmaLinux release 8.10 (Cerulean Leopard)  
[OpenNebula 6.8.3]

Linking iptables with ipset  
set the settings in /etc/sysconfig/iptables-config  
IPTABLES\_SAVE\_ON\_STOP="no”  
IPTABLES\_SAVE\_ON\_RESTART="no”

I set it because iptables often crashes from an error.  
set one-123-ip-spoofing doesen’t exist

In /etc/sysconfig/ipset.d rules are created as needed.

Now the problem is that when I restart iptables, all rules except my default ones crash.

Can you tell me how to load slave rules for all machines on the node without saving the rules to /etc/sysconfig/iptables?

---

<div class="post-metadata">

**Author:** ![dclavijo](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/dclavijo/32/5265_2.png) [@dclavijo](https://forum.opennebula.io/u/dclavijo)\
**Post date:** [September 20, 2024, 2:50pm UTC](https://forum.opennebula.io/t/iptables-ipset/12446/2 "2024-09-20T14:50:29Z")

</div>

When an OpenNebula virtual network is used by a VM, the virtual network driver will automatically create the network bridge, the virtual interfaces used by the VM and the iptables rules it requires. As VMs get created and deleted these rules and interfaces will be automatically updated as well.