Re: how to discard a netfilter rule

["Rob Sterenborg (lists)" <lists@sterenborg.info>]

On 02/28/2013 07:26 AM, Donghua Liu wrote:
> Hi,
>
> Say if I set a netfilter rule by "iptables -t nat -A custom_chain -p
> tcp -dport 80 -j DNAT --to-destination 127.0.0.1:1234" for some
> requirement.
>
> I also have a LKM which will check the availablity of service
> "127.0.0.1:1234" and how can I cancel the rule's operation(Do NOT
> delete this rule), let the packet go as usual ignore the nat.

man iptables says there is a -R command to replace rules:

----
        -R, --replace chain rulenum rule-specification
               Replace a rule in the selected chain.  If the source 
and/or destination names resolve to multiple addresses, the command will 
fail.  Rules are numbered starting at 1.
----

Assuming you know which rulenum must be changed, you can do this:

iptables -t nat -R custom_chain 1 -p tcp -dport 80

IOW, lose the -j parameter from the rule, keeping the others. The result 
is that the rule will still be there, but effectively won't do anything 
except for matching and updating packet/byte counting.


--
Rob