When do iptables take effect when using iptables-restore

When do iptables take effect when using iptables-restore

[Joubert Berger]

Say I have 10,000 rules loaded.

I now want to update them, so I edit my file and then run
iptables-restore to load the new rules.

During all this iptables is applying policy on packets.  So, what
happens between the time I start running iptables-restore and when it
finishes it?  Does it flush all the  rules and then load the news
ones?  Does that mean during this time I don't have iptables
enforcement going on?   Or does Iptables-restore load all the rules in
memory and then, when the commit happens, moves pointers around so
that enforcement is in effect all the time?

Another question I have is about connection tracking.  Do they get
flushed when we do a save-restore?  Say we allowed 10.10.3.3 through,
and currently  connection tracking is tracking this IP.  Now, we add a
rule to block 10.10.3.3.  But, connection tracking  is allowing it
through.  How does one solve this problem?

--joubert

Re: When do iptables take effect when using iptables-restore

[Rakotomandimby (R12y) Mihamina]

On Fri, 2005-05-13 at 11:35 -0400, Joubert Berger wrote:
> Say I have 10,000 rules loaded.

God!

> I now want to update them, so I edit my file and then run
> iptables-restore to load the new rules.

Why wouldn't you deal with a shell script to do so?
With a shell script you would exactly know what rules are applied at a
moment.

> During all this iptables is applying policy on packets.  So, what
> happens between the time I start running iptables-restore and when it
> finishes it? 

If you update your rules, one thing you will have to do is to flush,
anyway. If you dont, you'd append your updates to the existent rules. So
once you flushed, I think your "reore" file is read line by line and the
rules are applied as well as it is read.

But that's just my opinion. I habe no technical arguments, as you
see :-)


-- 
ASPO Infogérance       http://aspo.rktmb.org/activites/infogerance
Unofficial FAQ fcolc   http://faq.fcolc.eu.org/
LUG sur Orléans et alentours (France).
Tél : 02 34 08 26 04 / 06 33 26 13 14

Re: When do iptables take effect when using iptables-restore

[Joubert Berger]

On 5/13/05, Rakotomandimby (R12y) Mihamina
<mihamina.rakotomandimby@etu.univ-orleans.fr> wrote:
> 
> > I now want to update them, so I edit my file and then run
> > iptables-restore to load the new rules.
> 
> Why wouldn't you deal with a shell script to do so?
> With a shell script you would exactly know what rules are applied at a
> moment.
> 

It is done in a shell script :-)

> > During all this iptables is applying policy on packets.  So, what
> > happens between the time I start running iptables-restore and when it
> > finishes it?
> 
> If you update your rules, one thing you will have to do is to flush,
> anyway. If you dont, you'd append your updates to the existent rules. So
> once you flushed, I think your "reore" file is read line by line and the
> rules are applied as well as it is read.
> 

If I was executing individual iptables commands, I understand what the
impact is.  Once I flush the tables there would be no rules there. 
Then, as I add each policy, I would know that the policy changes as I
add each rule one at a time.

But I am not sure how iptables-restore works.  From what I have read,
it is considered an atomic action.  But, what does that mean?  Build
the entire rules in kernel memory and then at the end hook this into
the iptables search mechanism?  Or does it clear the table, then adds
each rule one at the time at the same time it is also evaluating
packets coming in.  Another way of asking it might be, is the atomic
operation at the iptables-restore level or at the kernel level?  Not
sure if I am explaining what I am looking after :-)

--joubert