Re: When do iptables take effect when using iptables-restore

[Joubert Berger <joubertb@gmail.com>]

On 5/13/05, Rakotomandimby (R12y) Mihamina
<mihamina.rakotomandimby@etu.univ-orleans.fr> wrote:
> 
> > I now want to update them, so I edit my file and then run
> > iptables-restore to load the new rules.
> 
> Why wouldn't you deal with a shell script to do so?
> With a shell script you would exactly know what rules are applied at a
> moment.
> 

It is done in a shell script :-)

> > During all this iptables is applying policy on packets.  So, what
> > happens between the time I start running iptables-restore and when it
> > finishes it?
> 
> If you update your rules, one thing you will have to do is to flush,
> anyway. If you dont, you'd append your updates to the existent rules. So
> once you flushed, I think your "reore" file is read line by line and the
> rules are applied as well as it is read.
> 

If I was executing individual iptables commands, I understand what the
impact is.  Once I flush the tables there would be no rules there. 
Then, as I add each policy, I would know that the policy changes as I
add each rule one at a time.

But I am not sure how iptables-restore works.  From what I have read,
it is considered an atomic action.  But, what does that mean?  Build
the entire rules in kernel memory and then at the end hook this into
the iptables search mechanism?  Or does it clear the table, then adds
each rule one at the time at the same time it is also evaluating
packets coming in.  Another way of asking it might be, is the atomic
operation at the iptables-restore level or at the kernel level?  Not
sure if I am explaining what I am looking after :-)

--joubert