---
title: 'Tutorial: Managing iptables Settings in Access Server'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--manage-iptables/
product: Access Server Docs
description: Manage iptables settings for Access Server, an advanced option that allows you to change the rule-prepending behavior, restore default settings, and disable specific iptables management activities.
---

# Tutorial: Managing iptables Settings in Access Server

## Overview

This tutorial guides you through managing the iptables settings in Access Server. You'll learn to change the rule-prepending behavior, restore default settings, and disable specific iptables management activities if necessary.

## Prerequisites

- An installed Access Server.
- Console access and the ability to get root access.
- Basic knowledge of iptables and Linux command line.

## Step 1: Manage iptables settings

1. Connect to the console and get root privileges.
2. Switch to the scripts directory:

   ```
   cd /usr/local/openvpn_as/scripts/
   ```
3. Use the desired commands below:
   - Change rule-prepending behavior to make Access Server append rules after existing ones (instead of prepending):

     ```
     ./sacli --key "iptables.append" --value "True" ConfigPut
     ./sacli start
     ```
   - Restore the default behavior of prepending rules:

     ```
     ./sacli --key "iptables.append" ConfigDel
     ./sacli start
     ```

## Step 2: Turn off Access Server's iptables Management (optional)

> **Important**
>
> We don't recommend turning off Access Server's iptables management unless you have the required knowledge to manage iptables manually.
>
> Access Server manages three distinct iptables items: filter, NAT, and mangle.

1. Connected to the console in the scripts directory, run the desired commands:
   - Turn off iptables filter management:

     ```
     ./sacli --key "iptables.vpn.disable.filter" --value "True" ConfigPut
     ./sacli start
     ```
   - Restore the default filter management:

     ```
     ./sacli --key "iptables.vpn.disable.filter" ConfigDel
     ./sacli start
     ```
   - Turn off iptables NAT management:

     ```
     ./sacli --key "iptables.vpn.disable.nat" --value "True" ConfigPut
     ./sacli start
     ```
   - Restore the default NAT management:

     ```
     ./sacli --key "iptables.vpn.disable.nat" ConfigDel
     ./sacli start
     ```
   - Turn off iptables mangle management:

     ```
     ./sacli --key "iptables.vpn.disable.mangle" --value "True" ConfigPut
     ./sacli start
     ```
   - Restore the default mangle management:

     ```
     ./sacli --key "iptables.vpn.disable.mangle" ConfigDel
     ./sacli start
     ```

---

Prev: [Tutorial: Configure Global NAT Behavior Settings](https://openvpn.net/as-docs/tutorials/tutorial--global-nat.md)
Next: [Tutorial: Allow UDP Multicast and IGMP to Pass Through](https://openvpn.net/as-docs/tutorials/tutorial--udp-multicast-and-igmp-allowed.md)
Index: https://openvpn.net/as-docs/llms.txt