LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   Restore iptables Rules that have been saved with iptables-save (http://www.linuxquestions.org/questions/linux-security-4/restore-iptables-rules-that-have-been-saved-with-iptables-save-826222/)

tiuz 08-14-2010 11:47 AM

Restore iptables Rules that have been saved with iptables-save
 
Hello,

A while ago i have saved iptables Rules with iptables-save to a file.

Now i need to do some modifikations and i would like to know if there is a way to get the contents of the file that has been saved with iptables-save back to "Human Readable form again"

For example: THIS form:

# Generated by iptables-save v1.3.5 on Sat Oct 28 15:10:09 2006
*mangle
:PREROUTING ACCEPT [40511857:54699979328]
:INPUT ACCEPT [40485221:54677480953]
:FORWARD ACCEPT [26394:22470203]
:OUTPUT ACCEPT [22521741:1599930162]
:POSTROUTING ACCEPT [22544591:1622118540]
COMMIT
# Completed on Sat Oct 28 15:10:10 2006
# Generated by iptables-save v1.3.5 on Sat Oct 28 15:10:10 2006
*filter
:INPUT ACCEPT [40479586:54675697556]
:FORWARD ACCEPT [26385:22469703]
:OUTPUT ACCEPT [22515275:1599136686]
-A INPUT -i eth1 -j DROP
COMMIT
# Completed on Sat Oct 28 15:10:10 2006

Into this form (how you enter the rules with iptables):

iptables -A INPUT -i ppp0 -p tcp --dport 21 -j DROP

etc etc.....

Thanks,
tz

unSpawn 08-14-2010 01:45 PM

It's human readable form already and you only have one filtering rule (which kind of fails to make sense anyway). Your new line you can add to the "*filter" table section below or instead of the "-A INPUT -i eth1 -j DROP" as "-A INPUT -i ppp0 -p tcp --dport 21 -j DROP".

tiuz 08-14-2010 04:05 PM

Erm, well itīs only a part of the iptables-saved file (not the full one) and the line with A INPUT -i eth1 -j DROP was where just examples. I just want to know if itīs possible to get rules that have been saved with iptables-save back into a form as you give with iptables.

I mean you donīt enter
:PREROUTING ACCEPT [40511857:54699979328]
:INPUT ACCEPT [40485221:54677480953]
:FORWARD ACCEPT [26394:22470203] etc...etc...

in the command line

tz

unSpawn 08-14-2010 05:33 PM

Here's a kludge:
Code:

cat /path/to/iptables-save | while read LINE; do
 case "${LINE}" in
  \**) export TABLE="${LINE:1}";;
  :*)  LINE=(${LINE}) ; echo "/sbin/iptables -t "${TABLE} -P ""${LINE[0]:1:255}" "${LINE[1]}"";;
  -A*) echo "/sbin/iptables -t ${TABLE} ${LINE}";;
 esac
done

YMMV(VM)

tiuz 08-14-2010 05:50 PM

Nice one ! THANKS !!


All times are GMT -5. The time now is 05:49 AM.