Re: iptables rules in comparable form

[Radek Kanovsky <rk@dat.cz>]

On Tue, Jun 01, 2010 at 10:29:10PM +0200, Pieter Smit wrote:

> Radek, your problem is getting the rules into a standard format, where
> you can match them to existing rules.
> 
> Would a solution/workaround not be to
> 1. create a dummy test chain/table not being used.
> 2. add new rules to the chain/table  (have to modify them slightly) 1 by 1
> 3. retrieve them in a standard form as provided by iptables-save -t test
> 4. spend time in python routine to match and decide what to remove/update.
> 5. make single insertion/replacement if needed.
> 6. clear test table and start with next rule.

Its not viable because I need also minimize the number of iptables operations.

Another solution could be to dynamicaly load iptables extensions
modules into my script and use somehow their parameter processing
code if possible.

Regards

Radek Kanovsky