Re: Creating rules without the /sbin/iptables command?

[Victor Julien <victor@nk.nl>]

John A. Sullivan III wrote:

<snip>

>>
>>Okay, lets see if I understand what you mean. Say i have an initial 
>>ruleset which looks like this, loaded with 'iptables-restore':
>>
>>*filter
>>:FORWARD DROP
>>-A FORWARD -p tcp -s 192.168.0.1 --dport 80 -j ACCEPT
>>-A FORWARD -p tcp -s 192.168.0.2 --dport 80 -j ACCEPT
>>-A FORWARD -p tcp -s 192.168.0.3 --dport 80 -j ACCEPT
>>COMMIT
>>
>>and sometime later i want to replace 192.168.0.2 by 192.168.0.4 (in 
>>exacty the same place):
>>
>>*filter
>>:FORWARD DROP
>>-D FORWARD -p tcp -s 192.168.0.2 --dport 80 -j ACCEPT
>>-I FORWARD 2 -p tcp -s 192.168.0.4 --dport 80 -j ACCEPT
>>COMMIT
>>
>>and then 'iptables-restore -n', right?
> 
> I believe that is correct although I also believe you can dispense with
> the :FORWARD DROP since you already had it in the first rule set and
> could also use 
> -R FORWARD 2 -p tcp -s 192.168.0.4 --dport -j ACCEPT
> to just replace the rule although I confess to never having tried that
> in an iptables-restore file
> 
>>But the easiest way is to recreate the initial ruleset with the updated 
>>rules would be:
>>
>>*filter
>>:FORWARD DROP
>>-A FORWARD -p tcp -s 192.168.0.1 --dport 80 -j ACCEPT
>>-A FORWARD -p tcp -s 192.168.0.4 --dport 80 -j ACCEPT
>>-A FORWARD -p tcp -s 192.168.0.3 --dport 80 -j ACCEPT
>>COMMIT
>>
>>and then just call iptables-restore. This way i wont have to calculate 
>>where i want to insert the rules, this can be quite complex on many 
>>changes in large rulessets. Is this correct?
> 
> Yes, although when ISCS is released (http://iscs.sourceforge.net), it
> will provide an alternative to having to track rule order (massive
> oversimplification here but it is not the topic at hand).

But how will ISCS handle this problem? Will it also create input for 
iptables-restore? Or do you have some other method?

> 
>>The last method should still be way faster than my current method, i 
>>guess. Is this right?
> 
> I have found it to be dramatically faster - John

Good!

Regards,
Victor

> 
>>Regards,
>>Victor