Deleting Rules

Deleting Rules

[Paul Caritj]

Simple Question:

Is it possible to delete rules without complete knowledge of its 
contents? E.g., Would it be possible to delete all rules that match a 
source ip of X?

If not, can anyone reccomend a workaround? I am creating rules on the 
fly and setting them to mark packets with a flag that would not be 
knowable subsequently. (Rather, unknowable unless there is no solution 
to this problem and I am forced to keep some sort of log...eew)


Thanks,
Paul

Re: Deleting Rules

[Chris Brenton]

Paul Caritj wrote:
> 
> Is it possible to delete rules without complete knowledge of its 
> contents? E.g., Would it be possible to delete all rules that match a 
> source ip of X?

Not in my experience. Its only worked for me when I specify all the same 
options that are in the original rule.

> If not, can anyone recommend a workaround?

Maybe you can grep the output from '-L -nv' to search for the IP address 
you want, and then use info in the output to create your delete rule?

HTH,
C

RE: Deleting Rules

[Sebastian]

Hi

Try around with something like this:
iptables -L INPUT -n --line-numbers | \
awk -- '{ if ($5=="192.168.0.1") { iptables -D INPUT $1 } }'

This will delete all entries in INPUT chain with source IP (column 5) of
192.168.0.1
Pearhaps you have to optimize some things to fit your needs.

Greets
Sebastian.


> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Paul Caritj
> Sent: Sunday, September 14, 2003 11:00 AM
> To: netfilter@lists.netfilter.org
> Subject: Deleting Rules
> 
> 
> Simple Question:
> 
> Is it possible to delete rules without complete knowledge of its 
> contents? E.g., Would it be possible to delete all rules that match a 
> source ip of X?
> 
> If not, can anyone reccomend a workaround? I am creating rules on the 
> fly and setting them to mark packets with a flag that would not be 
> knowable subsequently. (Rather, unknowable unless there is no 
> solution 
> to this problem and I am forced to keep some sort of log...eew)
> 
> 
> Thanks,
> Paul
> 
> 
>