これもすぐに設定の仕方を忘れるので覚書。

まずは、iptables-persistentをインストールしておく。設定ファイルは、/etc/iptables/rules.v4と/etc/iptables/rules.v6。もちろん環境に合わせて書き換える。私の場合はipv4が

# Generated by iptables-save v1.4.21 on Fri Feb 12 17:18:19 2016
*nat
:PREROUTING ACCEPT [2:104]
:INPUT ACCEPT [1:64]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Fri Feb 12 17:18:19 2016
# Generated by iptables-save v1.4.21 on Fri Feb 12 17:18:19 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [3:349]
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport hogehoge -j ACCEPT
-A INPUT -p tcp -m tcp --dport hogehoge -j ACCEPT
-A INPUT -p udp --dport 500 -j ACCEPT
-A INPUT -p udp --dport 4500 -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Fri Feb 12 17:18:19 2016

ipv6が

# Generated by ip6tables-save v1.4.21 on Fri Feb 12 17:18:19 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport hogehoge -j ACCEPT
-A INPUT -p tcp -m tcp --dport hogehoge -j ACCEPT
COMMIT
# Completed on Fri Feb 12 17:18:19 2016

こんな感じ。

あとは、以下のコマンドです。

netfilter-persistent reload