Re: Check for rule existence

[Grant Taylor <gtaylor@riverviewtech.net>]

On 06/14/10 12:23, Curby wrote:
> Just a quick note that you might want to look at iptables-save
> instead of vanilla iptables if you aren't already.  The former
> command gives the rules in a sort of canonical form that is used for
> restoring rulesets.  You'll have fewer spacing issues and such.
> Hopefully others will have more to add. =)

(iptables-save) Agreed.

I'd also recommend that you apply your rule and see how iptables-save 
will regurgitate the same rule back at you.  Especially if you are doing 
a textual comparison of the rule.

If you aren't doing a textual comparison of the rule and are actually 
breaking it out in to its individual elements (like command line 
argument processing) you will have a better chance of matching the rule 
on more systems.  Something as simple as a different interface name will 
throw off your textual match.  I.e. "eth0" is actually "eth1".

Depending on how system agnostic you are trying to bee, processing the 
rule as if it were a command line (looking for individual pieces) will 
probably be the easiest to do.



Grant. . . .