Re: [RFC] iptables namespaces

[Martijn Lievaart <m@rtij.nl>]

Steven Van Acker wrote:
> On Fri, Sep 07, 2007 at 08:46:42PM +0200, Maximilian Wilhelm wrote:
>   
>>> The result is that for 1 minute, some traffic can get through the firewall rules
>>> while other can not. We have had problems with spam getting through to 
>>> mailservers behind the firewall, because not all firewall rules were loaded.
>>>       
>> That problem can be solved.
>> man iptables-restore
>>     
>
> iptables-restore takes a file as input, not a series of iptables
> commands. This means I would have to edit the file manually, not
> something I want to do with 7000 firewall rules.
>   

The write a script. I use Perl for this, but then, I'm a freak. But most 
existing scripts can be trivialy modified to produce a file which can be 
fed to iptables-restore.

Something along the lines of (completely untested, my bash is very rusty):

IPTABLES=writeit
 >rulez
#IPTABLES=/sbin/iptables # To slow!

function writeit {
   echo $@ >>rulez
}

$IPTABLES -A INPUT -p tcp ... etc

You'll have to write some preamble and COMMIT afterwards, that is left 
as an execise for the reader.

HTH,
M4